FreeBSD VuXML

Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Security issues that affect the FreeBSD operating system or applications in the FreeBSD Ports Collection are documented using the Vulnerabilities and Exposures Markup Language (VuXML). The current VuXML document that serves as the source for the content of this site can be found:

Please report security issues to the FreeBSD Security Team at . Full contact details, including information handling policies and PGP key, can be found on the FreeBSD Security page.

modified date index


Modified Topic
2014-10-22 phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page.
2014-10-21 asterisk -- Asterisk Susceptibility to POODLE Vulnerability
2014-10-18 libxml2 -- Denial of service
2014-10-16 drupal7 -- SQL injection
mozilla -- multiple vulnerabilities
2014-10-15 OpenSSL -- multiple vulnerabilities
2014-10-09 foreman-proxy SSL verification issue
2014-10-08 chromium -- multiple vulnerabilities
2014-10-06 Bugzilla multiple security issues
2014-10-02 rt42 -- vulnerabilities related to shellshock
rsyslog -- remote syslog PRI vulnerability
2014-10-01 phpMyAdmin -- XSS vulnerabilities
bash -- remote code execution
jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS
bash -- out-of-bounds memory access in parser
2014-09-29 fish -- local privilege escalation and remote code execution
2014-09-25 Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11
NSS -- RSA Signature Forgery
chromium -- RSA signature malleability in NSS
krfb -- Multiple security issues in bundled libvncserver
bash -- remote code execution vulnerability
2014-09-18 asterisk -- Remotely triggered crash
squid -- Buffer overflow in SNMP processing
2014-09-17 dbus -- multiple vulnabilities
2014-09-16 nginx -- inject commands into SSL session vulnerability
2014-09-13 phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature
2014-09-11 security/ossec-hids-* -- root escalation via temp files
2014-09-09 www/chromium -- multiple vulnerabilities
2014-09-05 trafficserver -- unspecified vulnerability
2014-09-03 apache22 -- several vulnerabilities
2014-08-26 chromium -- multiple vulnerabilities
2014-08-21 file -- buffer overruns and missing buffer size tests
django -- multiple vulnerabilities
2014-08-18 PHP multiple vulnerabilities
2014-08-17 phpMyAdmin -- XSS vulnerabilities
2014-08-13 chromium -- multiple vulnerabilities
2014-08-11 serf -- SSL Certificate Null Byte Poisoning
subversion -- several vulnerabilities
2014-08-09 nginx -- inject commands into SSL session vulnerability
2014-08-06 OpenSSL -- multiple vulnerabilities
2014-08-03 krfb -- Possible Denial of Service or code execution via integer overflow
2014-08-02 samba -- remote code execution
gpgme -- heap-based buffer overflow in gpgsm status handler
2014-07-31 kdelibs -- KAuth PID Reuse Flaw
2014-07-30 tor -- traffic confirmation attack
2014-07-28 i2p -- Multiple Vulnerabilities
2014-07-25 bugzilla -- Cross Site Request Forgery
2014-07-23 mozilla -- multiple vulnerabilities
tomcat -- multiple vulnerabilities
2014-07-21 mcollective -- cert valication issue
qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler
2014-07-20 phpMyAdmin -- multiple XSS vulnerabilities, missing validation
2014-07-19 apache24 -- several vulnerabilities
2014-07-16 chromium -- multiple vulnerabilities
kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw
2014-07-13 postfixadmin -- SQL injection vulnerability
2014-07-03 dbus -- multiple vulnabilities
2014-06-28 mencoder -- potential buffer overrun when processing malicious lzo compressed input
mplayer -- potential buffer overrun when processing malicious lzo compressed input
2014-06-26 LZO -- potential buffer overrun when processing malicious input data
2014-06-24 phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names
2014-06-23 samba -- multiple vulnerabilities
gnupg -- possible DoS using garbled compressed data packets
2014-06-18 iodined -- authentication bypass
2014-06-17 asterisk -- multiple vulnerabilities
2014-06-14 dbus -- local DoS
2014-06-10 chromium -- multiple vulnerabilities
mozilla -- multiple vulnerabilities
2014-06-05 OpenSSL -- multiple vulnerabilities
2014-06-04 gnutls -- client-side memory corruption
2014-06-03 gnutls -- client-side memory corruption
2014-05-29 mumble -- multiple vulnerabilities
mumble -- NULL pointer dereference and heap-based buffer overflow
2014-05-26 linux-flashplugin -- multiple vulnerabilities
2014-05-24 openjpeg -- Multiple vulnabilities
2014-05-20 chromium -- multiple vulnerabilities
2014-05-14 chromium -- multiple vulnerabilities
2014-05-13 libXfont -- X Font Service Protocol and Font metadata file handling issues
2014-05-06 libxml2 -- entity substitution DoS
2014-05-05 qt4-xml -- XML Entity Expansion Denial of Service
2014-05-04 strongswan -- Remote Authentication Bypass
2014-05-03 OpenSSL -- NULL pointer dereference / DoS
2014-04-30 mohawk -- multiple vulnerabilities
chromium -- multiple vulnerabilities
opera -- moderately severe issue
django -- multiple vulnerabilities
cURL -- inappropriate GSSAPI delegation
dbus-glib -- privledge escalation
libaudiofile -- heap-based overflow in Microsoft ADPCM compression module
Joomla! -- Core - Multiple Vulnerabilities
gnutls -- multiple certificate verification issues
subversion -- mod_dav_svn vulnerability
bind -- denial of service vulnerability
gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack
pycrypto -- PRNG reseed race condition
wordpress -- multiple vulnerabilities
bugzilla -- multiple vulnerabilities
py-graphite-web -- Multiple vulnerabilities
django -- denial-of-service via large passwords
django -- multiple vulnerabilities
wordpress -- multiple vulnerabilities
wordpress -- multiple vulnerabilities
opera -- execution of arbitrary code
opera -- execution of arbitrary code
opera -- multiple vulnerabilities
xlockmore -- local exploit
ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file
django -- multiple vulnerabilities
ImageMagick -- multiple vulnerabilities
libxml2 -- An off-by-one out-of-bounds write by XPointer
2014-04-29 mozilla -- multiple vulnerabilities
2014-04-23 OpenSSL -- Remote Data Injection / DoS
rails -- multiple vulnerabilities
Joomla! -- Core XSS Vulnerabilities
2014-04-18 bugzilla -- Cross-Site Request Forgery
bugzilla -- Social Engineering
2014-04-13 ChaSen -- buffer overflow
2014-04-11 OpenLDAP -- incorrect handling of NULL in certificate Common Name
nas -- multiple vulnerabilities
OpenSSL -- Local Information Disclosure
OpenSSL -- Remote Information Disclosure
2014-04-10 OpenSSL -- multiple vulnerabilities
openssl -- denial of service in DTLS implementation
2014-04-09 openafs -- Denial of Service
2014-04-08 chromium -- multiple vulnerabilities
2014-04-03 otrs -- Clickjacking issue
2014-04-01 php -- multiple vulnerabilities
2014-03-29 Icinga -- buffer overflow in classic web interface
file -- out-of-bounds access in search rules with offsets from input file
2014-03-28 php -- multiple vulnerabilities
2014-03-26 LibYAML input sanitization errors
2014-03-23 mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection
nginx-devel -- SPDY heap buffer overflow
nginx -- SPDY heap buffer overflow
2014-03-22 apache -- several vulnerabilities
2014-03-20 mozilla -- multiple vulnerabilities
2014-03-15 www/chromium -- multiple vulnerabities
2014-03-14 mutt -- denial of service, potential remote code execution
2014-03-13 wemux -- read-only can be bypassed
2014-03-11 samba -- multiple vulnerabilities
www/chromium --multiple vulnerabilities
2014-03-10 asterisk -- multiple vulnerabilities
2014-03-09 freetype2 -- Out of bounds read/write
2014-03-06 xmms -- Integer Overflow And Underflow Vulnerabilities
nginx -- SPDY memory corruption
2014-03-05 chromium -- multiple vulnerabilities
2014-03-03 file -- denial of service
2014-03-01 Python -- buffer overflow in socket.recvfrom_into()
2014-02-25 otrs -- XSS Issue
2014-02-24 chromium -- multiple vulnerabilities
2014-02-20 PostgreSQL -- multiple privilege issues
2014-02-15 phpMyAdmin -- Self-XSS due to unescaped HTML output in import.
jenkins -- multiple vulnerabilities
2014-02-14 lighttpd -- multiple vulnerabilities
2014-02-06 phpmyfaq -- multiple vulnerabilities
otrs -- multiple vulnerabilities
2014-02-05 linux-flashplugin -- multiple vulnerabilities
2014-02-04 mozilla -- multiple vulnerabilities
2014-02-01 libyaml heap overflow resulting in possible code execution
2014-01-29 socat -- buffer overflow with data from command line
2014-01-27 chromium -- multiple vulnerabilities
rt42 -- denial-of-service attack via the email gateway
strongswan -- multiple DoS vulnerabilities
2014-01-25 varnish -- DoS vulnerability in Varnish HTTP cache
2014-01-24 linux-flashplugin -- multiple vulnerabilities
2014-01-23 HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes
2014-01-16 virtualbox-ose -- local vulnerability
2014-01-15 chromium -- multiple vulnerabilities
2014-01-14 ntpd DRDoS / Amplification Attack using ntpdc monlist command
nagios -- denial of service vulnerability
2014-01-08 libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont
2014-01-06 openssl -- multiple vulnerabilities
2013-12-22 OpenX -- SQL injection vulnerability
2013-12-18 cURL library -- cert name check ignore with GnuTLS
2013-12-17 asterisk -- multiple vulnerabilities
phpmyfaq -- arbitrary PHP code execution vulnerability
2013-12-16 zabbix -- shell command injection vulnerability
2013-12-14 PHP5 -- memory corruption in openssl_x509_parse()
mozilla -- multiple vulnerabilities
2013-12-11 samba -- multiple vulnerabilities
2013-12-06 drupal -- multiple vulnerabilities
2013-12-05 chromium -- multiple vulnerabilities
2013-12-01 monitorix -- serious bug in the built-in HTTP server
2013-11-28 OpenTTD -- Denial of service using forcefully crashed aircrafts
2013-11-25 subversion -- multiple vulnerabilities
2013-11-24 ruby-gems -- Algorithmic Complexity Vulnerability
ruby-gems -- Algorithmic Complexity Vulnerability
2013-11-23 ruby -- Heap Overflow in Floating Point Parsing
2013-11-19 samba -- Private key in key.pem world readable
samba -- ACLs are not checked on opening an alternate data stream on a file or directory
nginx -- Request line parsing vulnerability
2013-11-15 chromium -- multiple memory corruption issues
2013-11-13 OpenSSH -- Memory corruption in sshd
2013-11-12 linux-flashplugin -- multiple vulnerabilities
chromium -- multiple vulnerabilities
2013-11-06 Quassel IRC -- SQL injection vulnerability
2013-11-01 gnutls -- denial of service
2013-10-31 mozilla -- multiple vulnerabilities
2013-10-28 mod_pagespeed -- critical cross-site scripting (XSS) vulnerability
2013-10-24 xorg-server -- use after free
2013-10-19 node.js -- DoS Vulnerability
2013-10-17 dropbear -- exposure of sensitive information, DoS
2013-10-15 chromium -- multiple vulnerabilities
2013-10-10 mod_fcgid -- possible heap buffer overwrite
2013-10-05 gnupg -- possible infinite recursion in the compressed packet parser
2013-10-03 xinetd -- ignores user and group directives for TCPMUX services
2013-10-02 polarssl -- Timing attack against protected RSA-CRT implementation
2013-10-01 chromium -- multiple vulnerabilities
2013-09-24 ruby -- Hostname check bypassing vulnerability in SSL client
2013-09-19 FreeBSD -- Cross-mount links between nullfs(5) mounts
FreeBSD -- Insufficient credential checks in network ioctl(2)
mozilla -- multiple vulnerabilities
2013-09-13 linux-flashplugin -- multiple vulnerabilities
2013-09-02 svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.
2013-08-29 cacti -- allow remote attackers to execute arbitrary SQL commands
asterisk -- multiple vulnerabilities
2013-08-21 chromium -- multiple vulnerabilities
2013-08-20 gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav
2013-08-19 lcms2 -- Null Pointer Dereference Denial of Service Vulnerability
2013-08-17 GnuPG and Libgcrypt -- side-channel attack vulnerability
2013-08-16 puppet -- multiple vulnerabilities
2013-08-15 polarssl -- denial of service vulnerability
2013-08-09 samba -- denial of service vulnerability
2013-08-08 mozilla -- multiple vulnerabilities
2013-08-07 PuTTY -- Four security holes in versions before 0.63
PuTTY -- Password vulnerability
2013-08-05 typo3 -- Multiple vulnerabilities in TYPO3 Core
2013-08-04 phpMyAdmin -- clickJacking protection can be bypassed
2013-08-03 chromium -- multiple vulnerabilities
2013-08-01 puppet -- Unauthenticated Remote Code Execution Vulnerability
2013-07-29 phpMyAdmin -- multiple vulnerabilities
2013-07-27 bind -- denial of service vulnerability
2013-07-26 gnupg -- side channel attack on RSA secret keys
2013-07-25 openafs -- single-DES cell-wide key brute force vulnerability
subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow.
2013-07-22 suPHP -- Privilege escalation
2013-07-21 apache24 -- several vulnerabilities
2013-07-18 linux-flashplugin -- multiple vulnerabilities
2013-07-17 gallery -- multiple vulnerabilities
2013-07-16 PHP5 -- Heap corruption in XML parser
PHP5 -- Integer overflow in Calendar module
2013-07-15 squid -- denial of service
2013-07-11 libzrtpcpp -- multiple security vulnerabilities
otrs -- Sql Injection + Xss Issue
2013-07-10 libxml2 -- lack of end-of-document check DoS
chromium -- multiple vulnerabilities
apache22 -- several vulnerabilities
2013-07-01 cURL library -- heap corruption in curl_easy_unescape
2013-06-30 phpMyAdmin -- Global variable scope injection
2013-06-28 apache-xml-security-c -- heap overflow during XPointer evaluation
2013-06-26 mozilla -- multiple vulnerabilities
2013-06-19 otrs -- information disclosure
Wireshark -- Multiple Vulnerabilities
glpi -- remote attack via crafted POST request
asterisk -- SRTP Video Remote Crash Vulnerability
typo3 -- multiple vulnerabilities
clamav -- Multipart Nestings Denial of Service
sudo -- environmental variable CDPATH is not cleared
php -- strip_tags cross-site scripting vulnerability
Cyrus IMSPd multiple vulnerabilities
courier-imap -- format string vulnerability in debug mode
2013-06-18 FreeBSD -- Privilege escalation via mmap
apache-xml-security-c -- heap overflow
linux-flashplugin -- multiple vulnerabilities
FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys
2013-06-16 tor -- guard discovery
cacti -- SQL injection and command execution vulnerabilities
krb5 -- multiple denial of service vulnerabilities
php -- ini database truncation inside dba_replace() function
2013-06-13 dbus -- local dos
2013-06-11 owncloud -- Multiple security vulnerabilities
2013-06-07 php5 -- Heap based buffer overflow in quoted_printable_encode
dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone
2013-06-05 phpMyAdmin -- XSS due to unescaped HTML output in Create View page
telepathy-gabble -- TLS verification bypass
2013-06-04 xorg -- protocol handling issues in X Window System client libraries
chromium -- multiple vulnerabilities
2013-06-03 krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443]
net/openafs -- buffer overflow
www/mod_security -- NULL pointer dereference DoS
2013-06-01 passenger -- security vulnerability
OpenVPN -- potential side-channel/timing attack when comparing HMACs
2013-05-31 devel/subversion -- svnserve remotely triggerable DoS
devel/subversion -- contrib hook-scripts can allow arbitrary code execution
devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames
irc/bitchx -- multiple vulnerabilities
2013-05-28 znc -- null pointer dereference in webadmin module
2013-05-26 socat -- FD leak
ruby -- Object taint bypassing in DL and Fiddle in Ruby
couchdb -- DOM based Cross-Site Scripting via Futon UI
2013-05-23 otrs -- information disclosure
otrs -- XSS vulnerability
RT -- multiple vulnerabilities
2013-05-22 chromium -- multiple vulnerabilities
2013-05-21 mozilla -- multiple vulnerabilities
2013-05-19 plib -- stack-based buffer overflow
plib -- buffer overflow
2013-05-16 linux-flashplugin -- multiple vulnerabilities
nginx -- multiple vulnerabilities
2013-05-13 emacs -- remote code execution vulnerability
2013-05-03 jenkins -- multiple vulnerabilities
strongSwan -- ECDSA signature verification issue
2013-05-02 squid -- denial of service
2013-04-29 FreeBSD -- NFS remote denial of service
2013-04-27 Joomla! -- XXS and DDoS vulnerabilities
2013-04-24 phpMyAdmin -- Multiple security vulnerabilities
2013-04-22 tinc -- Buffer overflow
2013-04-20 phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page
2013-04-19 roundcube -- arbitrary file disclosure vulnerability
2013-04-18 jasper -- buffer overflow
2013-04-16 ModSecurity -- XML External Entity Processing Vulnerability
2013-04-15 sieve-connect -- TLS hostname verification was not occurring
2013-04-10 linux-flashplugin -- multiple vulnerabilities
rubygem-rails -- multiple vulnerabilities
2013-04-08 NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode
mozilla -- multiple vulnerabilities
2013-04-05 otrs -- Information disclosure and Data manipulation
Subversion -- multiple vulnerabilities
2013-04-04 PostgreSQL -- anonymous remote access data corruption vulnerability
2013-04-02 FreeBSD -- BIND remote denial of service
FreeBSD -- OpenSSL multiple vulnerabilities
2013-04-01 php -- multiple vulnerabilities
php -- _ecalloc Integer Overflow Vulnerability
php -- open_basedir Race Condition Vulnerability
2013-03-31 bugzilla -- multiple vulnerabilities
2013-03-29 libxml2 -- cpu consumption Dos
asterisk -- multiple vulnerabilities
2013-03-27 dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion
2013-03-26 chromium -- multiple vulnerabilities
2013-03-21 optipng -- use-after-free vulnerability
2013-03-18 php5 -- Multiple vulnerabilities
piwigo -- CSRF/Path Traversal
2013-03-16 libpurple -- multiple vulnerabilities
2013-03-13 libexif -- multiple remote vulnerabilities
puppet27 and puppet -- multiple vulnerabilities
puppet26 -- multiple vulnerabilities
2013-03-12 linux-flashplugin -- multiple vulnerabilities
2013-03-10 perl -- denial of service via algorithmic complexity attack on hashing routines
2013-03-08 mozilla -- Use-after-free in HTML Editor
chromium -- WebKit vulnerability
2013-03-06 firebird -- Remote Stack Buffer Overflow
typo3 -- Multiple vulnerabilities in TYPO3 Core
chromium -- multiple vulnerabilities
2013-03-03 stunnel -- Remote Code Execution
2013-03-02 apache22 -- several vulnerabilities
2013-03-01 sudo -- Authentication bypass when clock is reset
sudo -- Potential bypass of tty_tickets constraints
2013-02-28 rubygem-dragonfly -- arbitrary code execution
2013-02-27 linux-flashplugin -- multiple vulnerabilities
2013-02-25 otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution
otrs -- XSS vulnerability could lead to remote code execution
otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution
2013-02-24 rubygem-ruby_parser -- insecure tmp file usage
ruby -- DoS vulnerability in REXML
django -- multiple vulnerabilities
2013-02-22 krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415]
chromium -- multiple vulnerabilities
2013-02-21 FreeBSD -- glob(3) related resource exhaustion
FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query
drupal7 -- Denial of service
2013-02-20 nss-pam-ldapd -- file descriptor buffer overflow
mozilla -- multiple vulnerabilities
2013-02-17 Ruby Rack Gem -- Multiple Issues
Ruby Activemodel Gem -- Circumvention of attr_protected
jenkins -- multiple vulnerabilities
2013-02-16 poweradmin -- multiple XSS vulnerabilities
Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON
Ruby -- XSS exploit of RDoc documentation generated by rdoc
2013-02-08 linux-flashplugin -- multiple vulnerabilities
2013-02-06 OpenSSL -- TLS 1.1, 1.2 denial of service
2013-02-01 mysql/mariadb/percona server -- multiple vulnerabilities
opera -- execution of arbitrary code
2013-01-30 upnp -- multiple vulnerabilities
2013-01-25 django-cms -- XSS Vulnerability
2013-01-23 chromium -- multiple vulnerabilities
2013-01-20 drupal -- multiple vulnerabilities
2013-01-16 ettercap -- buffer overflow in target list parsing
2013-01-15 php -- potential overflow in _php_stream_scandir
2013-01-14 java 7.x -- security manager bypass
2013-01-11 chromium -- multiple vulnerabilities
2013-01-10 nagios -- buffer overflow in history.cgi
2013-01-09 mozilla -- multiple vulnerabilities
2013-01-08 rubygem-rails -- multiple vulnerabilities
jenkins -- HTTP access to the server to retrieve the master cryptographic key
2013-01-07 rubygem-rails -- SQL injection vulnerability
2013-01-06 django -- multiple vulnerabilities
moinmoin -- Multiple vulnerabilities
2013-01-05 freetype -- Multiple vulnerabilities
2013-01-03 asterisk -- multiple vulnerabilities
2013-01-02 ircd-ratbox and charybdis -- remote DoS vulnerability
2012-12-30 puppet -- multiple vulnerabilities
otrs -- XSS vulnerability
otrs -- XSS vulnerability in Firefox and Opera
otrs -- XSS vulnerability in Internet Explorer
2012-12-29 tomcat -- bypass of security constraints
2012-12-14 linux-flashplugin -- multiple vulnerabilities
2012-12-12 chromium -- multiple vulnerabilities
2012-12-04 tomcat -- bypass of CSRF prevention filter
tomcat -- denial of service
dns/bind9* -- servers using DNS64 can be crashed by a crafted query
2012-12-03 bogofilter -- heap corruption by invalid base64 input
2012-11-30 chromium -- multiple vulnerabilities
2012-11-29 YUI JavaScript library -- JavaScript injection exploits in Flash components
2012-11-27 chromium -- multiple vulnerabilities
bugzilla -- multiple vulnerabilities
2012-11-25 php -- NULL byte poisoning
2012-11-24 FreeBSD -- Linux compatibility layer input validation error
FreeBSD -- Insufficient message length validation for EAP-TLS messages
FreeBSD -- Multiple Denial of Service vulnerabilities with named(8)
2012-11-21 lighttpd -- remote DoS in header parsing
2012-11-20 mozilla -- multiple vulnerabilities
2012-11-18 weechat -- Arbitrary shell command execution via scripts
2012-11-13 weechat -- Crash or freeze when decoding IRC colors in strings
2012-11-12 typo3 -- Multiple vulnerabilities in TYPO3 Core
DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust
2012-11-10 ruby -- Hash-flooding DoS vulnerability for ruby 1.9
2012-11-09 tomcat -- Denial of Service
tomcat -- authentication weaknesses
2012-11-07 chromium -- multiple vulnerabilities
2012-11-05 linux-flashplugin -- multiple vulnerabilities
2012-11-02 linux-flashplugin -- multiple vulnerabilities
linux-flashplugin -- multiple vulnerabilities
apache22 -- several vulnerabilities
webmin -- potential XSS attack via real name field
2012-11-01 ruby -- Unintentional file creation caused by inserting an illegal NUL character
ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s
RT -- Multiple Vulnerabilities
2012-10-31 drupal7 -- multiple vulnerabilities
2012-10-27 mozilla -- multiple vulnerabilities
2012-10-26 Exim -- remote code execution
2012-10-24 django -- multiple vulnerabilities
2012-10-17 xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled
2012-10-16 Zend Framework -- Multiple vulnerabilities via XXE injection
2012-10-15 gitolite -- path traversal vulnerability
2012-10-14 phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack
2012-10-11 mozilla -- multiple vulnerabilities
2012-10-10 chromium -- multiple vulnerabilities
dns/bind9* -- crash on deliberately constructed combination of records
2012-10-08 chromium -- multiple vulnerabilities
2012-09-27 OpenX -- SQL injection vulnerability
2012-09-26 chromium -- multiple vulnerabilities
eperl -- Remote code execution
2012-09-19 php5-sqlite -- open_basedir bypass
php5 -- Denial of Service in php_date_parse_tzfile()
php5 -- header splitting attack via carriage-return character
2012-09-18 dns/bind9* -- Several vulnerabilities
2012-09-17 jenkins -- multiple vulnerabilities
2012-09-15 vlc -- arbitrary code execution in Real RTSP and MMS support
bacula -- Console ACL Bypass
2012-09-12 mod_pagespeed -- multiple vulnerabilities
NVIDIA UNIX driver -- access to arbitrary system memory
2012-09-11 freeradius -- arbitrary code execution for TLS-based authentication
moinmoin -- wrong processing of group membership
2012-09-07 wordpress -- multiple unspecified privilege escalation bugs
2012-09-05 moinmoin -- cross-site scripting via RST parser
wireshark -- denial of service in DRDA dissector
2012-09-04 squidclamav -- Denial of Service
fetchmail -- denial-of-service vulnerability
fetchmail -- address parsing vulnerability
2012-09-02 bitcoin -- denial of service
2012-09-01 bugzilla -- multiple vulnerabilities
GNU gatekeeper -- denial of service
mediawiki -- multiple vulnerabilities
2012-08-31 Java 1.7 -- security manager bypass
2012-08-30 chromium -- multiple vulnerabilities
asterisk -- multiple vulnerabilities
mozilla -- multiple vulnerabilities
coppermine -- Multiple vulnerabilites
fetchmail -- chosen plaintext attack against SSL CBC initialization vectors
asterisk -- multiple vulnerabilities
2012-08-27 roundcube -- cross-site scripting in HTML email messages
fetchmail -- two vulnerabilities in NTLM authentication
2012-08-26 Calligra, KOffice -- input validation failure
2012-08-25 squidclamav -- cross-site scripting in default virus warning pages
inn -- plaintext command injection into encrypted channel
automake -- Insecure 'distcheck' recipe granted world-writable distdir
2012-08-23 jabberd -- domain spoofing in server dialback protocol
2012-08-22 rssh -- configuration restrictions bypass
rssh -- arbitrary command execution
2012-08-18 libotr -- buffer overflows
OpenTTD -- Denial of Service
Wireshark -- Multiple vulnerabilities
2012-08-17 databases/postgresql*-server -- multiple vulnerabilities
phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages
2012-08-15 typo3 -- Multiple vulernabilities in TYPO3 Core
2012-08-13 Several vulnerabilities found in IcedTea-Web
2012-08-11 libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname
phpMyAdmin -- Path disclosure due to missing library
2012-08-10 chromium -- multiple vulnerabilities
www/chromium -- multiple vulnerabilities
chromium -- multiple vulnerabilities
rubygem-rails -- multiple vulnerabilities
2012-08-09 sudosh -- buffer overflow
2012-08-07 FreeBSD -- named(8) DNSSEC validation Denial of Service
2012-08-02 mozilla -- multiple vulnerabilities
2012-08-01 Apache -- Insecure LD_LIBRARY_PATH handling
2012-07-27 bugzilla -- multiple vulnerabilities
nsd -- Denial of Service
2012-07-26 rubygem-actionpack -- Denial of Service
p5-RT-Authen-ExternalAuth -- privilege escalation
2012-07-25 isc-dhcp -- multiple vulnerabilities
2012-07-24 dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure
2012-07-23 rubygem-activerecord -- multiple vulnerabilities
2012-07-21 dns/nsd -- DoS vulnerability from non-standard DNS packet
2012-07-19 libjpeg-turbo -- heap-based buffer overflow
2012-07-18 Dokuwiki -- cross site scripting vulnerability
2012-07-10 puppet -- multiple vulnerabilities
2012-07-08 openx -- undisclosed security issue
2012-07-06 typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core
2012-07-02 phpList -- SQL injection and XSS vulnerability
2012-06-27 chromium -- multiple vulnerabilities
FreeBSD -- Privilege escalation when returning from kernel
FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8)
FreeBSD -- Incorrect crypt() hashing
FreeBSD -- OpenSSL multiple vulnerabilities
2012-06-24 pycrypto -- vulnerable ElGamal key generation
2012-06-21 inspircd -- buffer overflow
2012-06-19 joomla -- Privilege Escalation
2012-06-16 clamav -- multiple vulnerabilities
2012-06-14 asterisk -- remote crash vulnerability
2012-06-13 mantis -- multiple vulnerabilities
2012-06-09 linux-flashplugin -- multiple vulnerabilities
2012-06-06 dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory
2012-06-05 mozilla -- multiple vulnerabilities
quagga -- BGP OPEN denial of service vulnerability
mail/sympa* -- Multiple vulnerabilities in Sympa archive management
2012-05-31 databases/postgresql*-server -- crypt vulnerabilities
2012-05-30 nut -- upsd can be remotely crashed
2012-05-29 asterisk -- multiple vulnerabilities
haproxy -- buffer overflow
2012-05-28 chromium -- multiple vulnerabilities
2012-05-23 RT -- Multiple Vulnerabilities
2012-05-21 sympa -- Multiple Security Bypass Vulnerabilities
foswiki -- Script Insertion Vulnerability via unchecked user registration fields
2012-05-16 pidgin-otr -- format string vulnerability
sudo -- netmask vulnerability
2012-05-15 chromium -- multiple vulnerabilities
2012-05-14 socat -- Heap-based buffer overflow
PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability
2012-05-12 php -- multiple vulnerabilities
libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests
2012-05-10 OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service
2012-05-09 rubygem-mail -- multiple vulnerabilities
2012-05-07 node -- private information disclosure
p5-Config-IniFiles -- unsafe temporary file creation
2012-05-06 portupgrade-devel -- lack of distfile checksums
2012-05-05 php -- vulnerability in certain CGI-based setups
2012-05-04 php -- multiple vulnerabilities
2012-05-02 WebCalendar -- multiple vulnerabilities
2012-05-01 chromium -- multiple vulnerabilities
2012-04-30 samba -- incorrect permission checks vulnerability
2012-04-27 net-snmp -- Remote DoS
2012-04-24 mozilla -- multiple vulnerabilities
2012-04-23 Dokuwiki -- cross site scripting vulnerability
asterisk -- multiple vulnerabilities
wordpress -- multiple vulnerabilities
2012-04-21 OpenSSL -- integer conversions result in memory corruption
bugzilla -- multiple vulnerabilities
2012-04-18 typo -- Cross-Site Scripting
2012-04-16 nginx -- Buffer overflow in the ngx_http_mp4_module
2012-04-14 phpmyfaq -- Remote PHP Code Execution Vulnerability
2012-04-10 puppet -- Multiple Vulnerabilities
bugzilla Cross-Site Request Forgery
samba -- "root" credential remote code execution
linux-flashplugin -- multiple vulnerabilities
2012-04-08 png -- memory corruption/possible remote code execution
2012-04-06 freetype -- multiple vulnerabilities
mutt-devel -- failure to check SMTP TLS server certificate
2012-04-05 chromium -- multiple vulnerabilities
2012-04-01 libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding
2012-03-28 phpMyAdmin -- Path disclosure due to missing verification of file presence
chromium -- multiple vulnerabilities
2012-03-26 quagga -- multiple vulnerabilities
2012-03-25 raptor/raptor2 -- XXE in RDF/XML File Interpretation
2012-03-24 Apache Traffic Server -- heap overflow vulnerability
libtasn1 -- ASN.1 length decoding vulnerability
gnutls -- possible overflow/Denial of service vulnerabilities
2012-03-22 chromium -- multiple vulnerabilities
2012-03-18 mozilla -- multiple vulnerabilities
mozilla -- heap-buffer overflow
mozilla -- multiple vulnerabilities
2012-03-15 asterisk -- multiple vulnerabilities
nginx -- potential information leak
OpenSSL -- CMS and S/MIME Bleichenbacher attack
2012-03-13 libXfont -- possible local privilege escalation
2012-03-11 portaudit -- auditfile remote code execution
chromium -- Errant plug-in load and GPU process memory corruption
2012-03-09 linux-flashplugin -- multiple vulnerabilities
chromium -- cross-site scripting vulnerability
2012-03-07 jenkins -- XSS vulnerability
2012-03-05 chromium -- multiple vulnerabilities
2012-03-04 dropbear -- arbitrary code execution
2012-02-28 databases/postgresql*-client -- multiple vulnerabilities
2012-02-27 linux-flashplugin -- multiple vulnerabilities
libxml2 -- heap buffer overflow
2012-02-26 Python -- DoS via malformed XML-RPC / HTTP POST request
2012-02-19 plib -- remote code execution via buffer overflow
2012-02-18 phpMyAdmin -- XSS in replication setup
2012-02-16 piwik -- xss and click-jacking issues
2012-02-15 chromium -- multiple vulnerabilities
2012-02-13 WebCalendar -- Persistent XSS
2012-02-11 mozilla -- use after free in nsXBLDocumentInfo::ReadPrototypeBindings
bip -- buffer overflow
surf -- private information disclosure
2012-02-09 chromium -- multiple vulnerabilities
2012-02-07 drupal -- multiple vulnerabilities
2012-02-06 bugzilla -- multiple vulnerabilities
php -- arbitrary remote code execution vulnerability
2012-02-03 mathopd -- directory traversal vulnerability
2012-01-31 apache -- multiple vulnerabilities
sudo -- format string vulnerability
2012-01-29 FreeBSD -- pam_ssh() does not validate service names
FreeBSD -- Buffer overflow in handling of UNIX socket addresses
FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1)
FreeBSD -- Network ACL mishandling in mountd(8)
krb5-appl -- telnetd code execution vulnerability
proftpd -- arbitrary code execution vulnerability with chroot
BIND -- Remote DOS
2012-01-27 postfixadmin -- Multiple Vulnerabilities
2012-01-26 mpack -- Information disclosure
acroread9 -- Multiple Vulnerabilities
2012-01-24 chromium -- multiple vulnerabilities
2012-01-23 Wireshark -- Multiple vulnerabilities
spamdyke -- Buffer Overflow Vulnerabilities
spamdyke -- STARTTLS Plaintext Injection Vulnerability
chromium -- multiple vulnerabilities
2012-01-20 OpenSSL -- DTLS Denial of Service
Multiple implementations -- DoS via hash algorithm collision
2012-01-19 php -- multiple vulnerabilities
2012-01-17 tomcat -- Denial of Service
2012-01-16 OpenTTD -- Denial of service (server) via slow read attack
2012-01-14 ffmpeg -- multiple vulnerabilities
OpenSSL -- multiple vulnerabilities
2012-01-13 isc-dhcp-server -- DoS in DHCPv6
2012-01-12 PowerDNS -- Denial of Service Vulnerability
2012-01-09 torcs -- untrusted local library loading
2012-01-05 bugzilla -- multiple vulnerabilities
2012-01-03 WordPress -- cross site scripting vulnerability
2011-12-29 zabbix-frontend -- multiple XSS vulnerabilities
2011-12-28 lighttpd -- remote DoS in HTTP authentication
2011-12-22 phpMyAdmin -- Multiple XSS
2011-12-21 mozilla -- multiple vulnerabilities
2011-12-19 unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence
2011-12-18 typo3 -- Remote Code Execution
2011-12-14 krb5 -- KDC null pointer dereference in TGS handling
2011-12-13 opera -- multiple vulnerabilities
chromium -- multiple vulnerabilities
2011-12-09 asterisk -- Multiple Vulnerabilities
2011-12-07 isc-dhcp-server -- Remote DoS
2011-12-01 phpMyAdmin -- Multiple XSS
2011-11-18 hiawatha -- memory leak in PreventSQLi routine
2011-11-17 chromium -- multiple vulnerabilities
2011-11-14 Apache 1.3 -- mod_proxy reverse proxy exposure
kdeutils4 -- Directory traversal vulnerability
2011-11-13 Apache APR -- DoS vulnerabilities
2011-11-12 phpmyadmin -- Local file inclusion
libxml -- Integer overflow
libxml -- Multiple use-after-free vulnerabilities
libxml -- Stack consumption vulnerability
2011-11-11 linux-flashplugin -- multiple vulnerabilities
2011-11-10 gnutls -- client session resumption vulnerability
2011-11-08 mozilla -- multiple vulnerabilities
2011-11-06 caml-light -- insecure use of temporary files
2011-11-01 freetype -- Some type 1 fonts handling vulnerabilities
django -- multiple vulnerabilities
2011-10-26 cacti -- Multiple vulnabilites
phpmyfaq -- Remote PHP Code Injection Vulnerability
2011-10-24 phpLDAPadmin -- Remote PHP code injection vulnerability
2011-10-23 kdelibs4, rekonq -- input validation failure
2011-10-20 piwik -- unknown critical vulnerabilities
2011-10-18 Xorg server -- two vulnerabilities in X server lock handling code
2011-10-17 asterisk -- remote crash vulnerability in SIP channel driver
PivotX -- Remote File Inclusion Vulnerability of TimThumb
2011-10-16 OpenTTD -- Multiple buffer overflows in validation of external data
OpenTTD -- Buffer overflows in savegame loading
OpenTTD -- Denial of service via improperly validated commands
2011-10-05 quagga -- multiple vulnerabilities
2011-09-30 tomcat -- Cross-site scripting vulnerability
2011-09-28 Mozilla -- multiple vulnerabilities
2011-09-23 horde-imp -- XSS vulnerability
2011-09-22 linux-flashplugin -- multiple vulnerabilities
2011-09-14 phpMyAdmin -- multiple XSS vulnerabilities
2011-09-13 roundcube -- XSS vulnerability
2011-09-12 libsndfile -- PAF file processing integer overflow
2011-09-06 nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl
2011-09-05 XSS issue in MantisBT
2011-09-04 security/cfs -- buffer overflow
ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle
tcl/tk -- buffer overflow in ReadImage function
2011-09-03 hlstats -- multiple cross site scripting vulnerabilities
2011-09-01 apache -- Range header DoS vulnerability
2011-08-30 PHP -- crypt() returns only the salt for MD5
2011-08-26 stunnel -- heap corruption vulnerability
2011-08-24 phpMyAdmin -- multiple XSS vulnerabilities
2011-08-20 php -- multiple vulnerabilities
2011-08-19 dovecot -- denial of service vulnerability
rubygem-rails -- multiple vulnerabilities
2011-08-18 OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system
2011-08-16 mozilla -- multiple vulnerabilities
Samba -- cross site scripting and request forgery vulnerabilities
2011-08-13 isc-dhcp-server -- server halt upon processing certain packets
dtc -- multiple vulnerabilities
bugzilla -- multiple vulnerabilities
2011-08-11 freetype2 -- execute arbitrary code or cause denial of service
2011-07-28 libsoup -- unintentionally allow access to entire local filesystem
phpmyadmin -- multiple vulnerabilities
phpmyadmin -- multiple vulnerabilities
2011-07-25 opensaml2 -- unauthenticated login
2011-07-20 rsync -- incremental recursion memory corruption vulnerability
2011-07-05 BIND -- Remote DoS against authoritative and recursive servers
BIND -- Remote DoS with certain RPZ configurations
2011-06-29 Asterisk -- multiple vulnerabilities
2011-06-27 mambo -- multiple SQL injection vulnerabilities
2011-06-24 ejabberd -- remote denial of service vulnerability
2011-06-23 mozilla -- multiple vulnerabilities
2011-06-21 Samba -- Denial of service - memory corruption
Piwik -- remote command execution vulnerability
2011-06-20 Dokuwiki -- cross site scripting vulnerability
2011-06-15 linux-flashplugin -- remote code execution vulnerability
ikiwiki -- tty hijacking via ikiwiki-mass-rebuild
2011-06-08 linux-flashplugin -- cross-site scripting vulnerability
2011-06-06 fetchmail -- STARTTLS denial of service
2011-06-04 BIND -- Large RRSIG RRsets and Negative Caching DoS
2011-06-02 asterisk -- Remote crash vulnerability
Subversion -- multiple vulnerabilities
2011-05-26 drupal6 -- multiple vulnerabilities
2011-05-25 Erlang -- ssh library uses a weak random number generator
Unbound -- an empty error packet handling assertion failure
2011-05-23 Pubcookie Login Server -- XSS vulnerability
mod_pubcookie -- Empty Authentication Security Advisory
ViewVC -- user-reachable override of cvsdb row limit
Apache APR -- DoS vulnerabilities
linux-flashplugin -- multiple vulnerabilities
pureftpd -- multiple vulnerabilities
Opera -- code injection vulnerability through broken frameset handling
2011-05-14 Exim -- remote code execution and information disclosure
2011-05-13 Zend Framework -- potential SQL injection when using PDO_MySql
2011-05-12 Apache APR -- DoS vulnerabilities
mediawiki -- multiple vulnerabilities
2011-05-09 Postfix -- memory corruption vulnerability
2011-04-29 Mozilla -- multiple vulnerabilities
2011-04-21 Asterisk -- multiple vulnerabilities
2011-04-17 VLC -- Heap corruption in MP4 demultiplexer
linux-flashplugin -- remote code execution vulnerability
rt -- multiple vulnerabilities
2011-04-14 krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled
krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285]
krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end
krb5 -- MITKRB5-SA-2011-001, kpropd denial of service
xrdb -- root hole via rogue hostname
2011-04-12 OTRS -- Several XSS attacks possible
2011-04-10 isc-dhcp-client -- dhclient does not strip or escape shell meta-characters
2011-04-08 tinyproxy -- ACL lists ineffective when range is configured
2011-04-01 quagga -- two DoS vulnerabilities
2011-03-29 gdm -- privilege escalation vulnerability
2011-03-25 php -- ZipArchive segfault with FL_UNCHANGED on empty archive
php -- crash on crafted tag in exif
2011-03-24 linux-flashplugin -- remote code execution vulnerability
mozilla -- update to HTTPS certificate blacklist
2011-03-19 postfix -- plaintext command injection with SMTP over TLS
2011-03-17 hiawatha -- integer overflow in Content-Length header parsing
2011-03-16 asterisk -- Multiple Vulnerabilities
2011-03-13 avahi -- denial of service
2011-03-10 mailman -- XSS vulnerability
2011-03-07 redmine -- XSS vulnerability
2011-03-05 subversion -- remote HTTP DoS vulnerability
2011-03-01 mozilla -- multiple vulnerabilities
2011-02-25 openldap -- two security bypass vulnerabilities
2011-02-22 asterisk -- Exploitable Stack and Heap Array Overflows
2011-02-20 PivotX -- administrator password reset vulnerability
2011-02-11 phpMyAdmin -- multiple vulnerabilities
linux-flashplugin -- multiple vulnerabilities
2011-02-10 mupdf -- Remote System Access
rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability
plone -- Remote Security Bypass
exim -- local privilege escalation
openoffice.org -- Multiple vulnerabilities
webkit-gtk2 -- Multiple vurnabilities.
awstats -- arbitrary commands execution vulnerability
opera -- multiple vulnerabilities
2011-02-09 django -- multiple vulnerabilities
mediawiki -- multiple vulnerabilities
wordpress -- SQL injection vulnerability
2011-02-02 vlc -- Insufficient input validation in MKV demuxer
2011-01-31 maradns -- denial of service when resolving a long DNS hostname
2011-01-28 isc-dhcp-server -- DHCPv6 crash
2011-01-25 bugzilla -- multiple serious vulnerabilities
2011-01-24 dokuwiki -- multiple privilege escalation vulnerabilities
2011-01-19 asterisk -- Exploitable Stack Buffer Overflow
tarsnap -- cryptographic nonce reuse
2011-01-17 tor -- remote code execution and crash
2011-01-13 sudo -- local privilege escalation
subversion -- multiple DoS
php-zip -- multiple Denial of Service vulnerabilities
php-filter -- Denial of Service
pecl-phar -- format string vulnerability
php-imap -- Denial of Service
php -- open_basedir bypass
php -- corruption of $GLOBALS and $this variables via extract() method
2011-01-11 MoinMoin -- cross-site scripting vulnerabilities
2011-01-09 php -- multiple vulnerabilities
2011-01-08 exim -- local privilege escalation
2011-01-06 mediawiki -- Clickjacking vulnerabilities
2010-12-30 webkit-gtk2 -- Multiple vulnabilities
2010-12-29 django -- multiple vulnerabilities
2010-12-28 Drupal Views plugin -- cross-site scripting
2010-12-23 redmine -- multiple vulnerabilities
2010-12-22 tor -- remote crash and potential remote code execution
2010-12-15 YUI JavaScript library -- JavaScript injection exploits in Flash components
2010-12-10 mozilla -- multiple vulnerabilities
2010-12-09 krb5 -- client impersonation vulnerability
krb5 -- unkeyed PAC checksum handling vulnerability
krb5 -- RFC 3961 key-derivation checksum handling vulnerability
krb5 -- multiple checksum handling vulnerabilities
krb5 -- multiple checksum handling vulnerabilities
2010-12-04 proftpd -- Compromised source packages backdoor
2010-11-30 phpMyAdmin -- XSS attack in database search
2010-11-24 isc-dhcp-server -- Empty link-address denial of service
2010-11-23 OpenTTD -- Denial of service (server/client) via invalid read
horde-base -- XSS: VCARD attachments vulnerability
proftpd -- remote code execution vulnerability
2010-11-17 openssl -- TLS extension parsing race condition
2010-11-06 linux-flashplugin -- multiple vulnerabilities
2010-11-05 Wireshark -- DoS in the BER-based dissectors
2010-11-03 Mailman -- cross-site scripting in web interface
OTRS -- Multiple XSS and denial of service vulnerabilities
2010-10-28 mozilla -- Heap buffer overflow mixing document.write and DOM insertion
2010-10-26 opera -- multiple vulnerabilities
2010-10-25 bzip2 -- integer overflow vulnerability
2010-10-24 FreeBSD -- Integer overflow in bzip2 decompression
FreeBSD -- Lost mbuf flag resulting in data corruption
FreeBSD -- Unvalidated input in nfsclient
FreeBSD -- OPIE off-by-one stack overflow
FreeBSD -- Insufficient environment sanitization in jail(8)
FreeBSD -- ntpd mode 7 denial of service
FreeBSD -- ZFS ZIL playback with insecure permissions
FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation
FreeBSD -- Inappropriate directory permissions in freebsd-update(8)
FreeBSD -- Improper environment sanitization in rtld(1)
FreeBSD -- SSL protocol flaw
monotone -- remote denial of service in default setup
2010-10-20 mozilla -- multiple vulnerabilities
apr -- multiple vunerabilities
2010-10-19 Webkit-gtk2 -- Multiple Vulnabilities
2010-10-02 phpmyfaq -- cross site scripting vulnerabilities
2010-09-28 horde-gollem -- XSS vulnerability
horde-base -- XSS and CSRF vulnerabilities
2010-09-26 openx -- remote code execution vulnerability
2010-09-24 squid -- Denial of service vulnerability in request handling
2010-09-22 linux-flashplugin -- remote code execution
2010-09-17 django -- cross-site scripting vulnerability
2010-09-15 mozilla -- multiple vulnerabilities
2010-09-10 webkit-gtk2 -- Multiple vulnabilities
2010-09-09 vim6 -- heap-based overflow while parsing shell metacharacters
2010-09-07 sudo -- Flaw in Runas group matching
2010-09-03 lftp -- multiple HTTP client download filename vulnerability
wget -- multiple HTTP client download filename vulnerability
2010-08-31 p5-libwww -- possibility to remote servers to create file with a .(dot) character
2010-08-25 quagga -- stack overflow and DoS vulnerabilities
2010-08-24 bugzilla -- information disclosure, denial of service
2010-08-22 OpenTTD -- Denial of service (server) via infinite loop
2010-08-21 corkscrew -- buffer overflow vulnerability
phpmyadmin -- Several XSS vulnerabilities
2010-08-20 slim -- insecure PATH assignment
ruby -- UTF-7 encoding XSS vulnerability in WEBrick
2010-08-14 vlc -- invalid id3v2 tags may lead to invalid memory dereferencing
2010-08-13 isolate -- local root exploit
linux-flashplugin -- multiple vulnerabilities
opera -- multiple vulnerabilities
2010-08-09 firefox -- Dangling pointer crash regression from plugin parameter array fix
2010-08-04 Piwik -- Local File Inclusion Vulnerability
2010-07-30 libmspack -- infinite loop denial of service
2010-07-26 apache -- Remote DoS bug in mod_cache and mod_dav
2010-07-23 git -- buffer overflow vulnerability
2010-07-21 codeigniter -- file upload class vulnerability
mozilla -- multiple vulnerabilities
2010-07-18 vte -- Classic terminal title set+query attack
webkit-gtk2 -- Multiple vulnabilities
2010-07-10 redmine -- multiple vulnerabilities
2010-07-06 bogofilter -- heap underrun on malformed base64 input
2010-07-05 bugzilla -- information disclosure
2010-06-30 kvirc -- multiple vulnerabilities
2010-06-28 png -- libpng decompression buffer overflow
moodle -- multiple vulnerabilities
2010-06-27 mDNSResponder -- corrupted stack crash when parsing bad resolv.conf
2010-06-25 opera -- Data URIs can be used to allow cross-site scripting
2010-06-24 cacti -- multiple vulnerabilities
2010-06-23 mozilla -- multiple vulnerabilities
2010-06-17 gd -- '_gdGetColors' remote buffer overflow vulnerability
2010-06-16 tiff -- Multiple integer overflows
2010-06-15 ziproxy -- security vulnerability in PNG decoder
2010-06-14 linux-flashplugin -- multiple vulnerabilities
2010-06-12 tiff -- buffer overflow vulnerability
2010-06-02 sudo -- Secure path vulnerability
mediawiki -- two security vulnerabilities
2010-05-28 ziproxy -- atypical huge picture files vulnerability
2010-05-14 redmine -- multiple vulnerabilities
2010-05-12 drupal -- multiple vulnerabilities
wordpress -- remote privilege escalation
drupal -- multiple vulnerabilities
opera -- multiple vulnerabilities
proftpd -- Long Command Processing Vulnerability
phpmyadmin -- Code execution vulnerability
rubygem-rails -- SQL injection vulnerability
opera -- multiple vulnerabilities
cdf3 -- Buffer overflow vulnerability
drupal -- multiple vulnerabilities
ruby -- multiple vulnerabilities in safe level
ruby -- DoS vulnerability in WEBrick
Bugzilla -- Directory Traversal in importxml.pl
drupal -- multiple vulnerabilities
phpmyadmin -- Cross Site Scripting Vulnerabilities
ikiwiki -- empty password security hole
spamdyke -- open relay
django -- XSS vulnerability
ikiwiki -- cross site request forging
suphp -- multiple local privilege escalation vulnerabilities
opera -- multiple vulnerabilities
phpmyadmin -- SQL injection vulnerability
opera -- multiple vulnerabilities
ikiwiki -- javascript insertion via uris
drupal -- cross site request forgery
drupal -- cross site scripting (utf8)
drupal -- cross site scripting (register_globals)
gallery2 -- multiple vulnerabilities
peercast -- buffer overflow vulnerability
phpmyadmin -- Cross Site Scripting
phpmyadmin -- cross-site scripting vulnerability
phpmyadmin -- cross-site scripting vulnerability
coppermine -- multiple vulnerabilities
bugzilla -- "createmailregexp" security bypass vulnerability
claws-mail -- POP3 Format String Vulnerability
joomla -- multiple vulnerabilities
lighttpd -- multiple vulnerabilities
opera -- multiple vulnerabilities
wireshark -- Multiple problems
vlc -- format string vulnerability and integer overflow
c-ares -- DNS Cache Poisoning Vulnerability
webmin -- cross site scripting vulnerability
phppgadmin -- cross site scripting vulnerability
p5-Imager -- possibly exploitable buffer overflow
freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability
Squid -- TRACE method handling denial of service
opera -- multiple vulnerabilities
drupal -- multiple vulnerabilities
tnftpd -- Remote root Exploit
ruby -- cgi.rb library Denial of Service
tdiary -- cross site scripting vulnerability
ingo -- local arbitrary shell command execution
drupal-pubcookie -- authentication may be bypassed
joomla -- multiple vulnerabilities
globus -- Multiple tmpfile races
alsaplayer -- multiple vulnerabilities
trac -- reStructuredText breach of privacy and denial of service vulnerability
horde -- various problems in dereferrer
2010-05-07 wireshark -- DOCSIS dissector denial of service
piwik -- cross site scripting vulnerability
2010-05-06 spamass-milter -- remote command execution vulnerability
squidGuard -- multiple vulnerabilities
2010-05-05 mediawiki -- authenticated CSRF vulnerability
lxr -- multiple XSS vulnerabilities
vlc -- unintended code execution with specially crafted data
2010-05-02 squid -- Denial of Service vulnerability in HTCP
otrs -- SQL injection
squid -- Denial of Service vulnerability in DNS handling
dokuwiki -- multiple vulnerabilities
drupal -- multiple cross-site scripting
pligg -- Cross-Site Scripting and Cross-Site Request Forgery
piwik -- php code execution
opera -- multiple vulnerabilities
libtool -- Library Search Path Privilege Escalation Issue
cacti -- cross-site scripting issues
wordpress -- multiple vulnerabilities
opera -- multiple vulnerabilities
django -- denial-of-service attack
virtualbox -- privilege escalation
fwbuilder -- security issue in temporary file handling
wordpress -- remote admin password reset vulnerability
silc-client -- Format string vulnerability
mozilla -- corrupt JIT state after deep return from native function
drupal -- multiple vulnerabilities
phpmyadmin -- XSS vulnerability
joomla -- multiple vulnerabilities
git -- denial of service vulnerability
ruby -- BigDecimal denial of service vulnerability
dokuwiki -- Local File Inclusion with register_globals on
wireshark -- PCNFSD Dissector Denial of Service Vulnerability
openfire -- Openfire No Password Changes Security Bypass
drupal -- cross site scripting
phpmyadmin -- insufficient output sanitizing when generating configuration file
drupal6-cck -- cross-site scripting
phpmyadmin -- insufficient output sanitizing when generating configuration file
wireshark -- multiple vulnerabilities
opera -- multiple vulnerabilities
typo3 -- cross-site scripting and information disclosure
tor -- unspecified memory corruption vulnerability
openfire -- multiple vulnerabilities
imap-uw -- imap c-client buffer overflow
imap-uw -- local buffer overflow vulnerabilities
vinagre -- format string vulnerability
drupal -- multiple vulnerabilities
phpmyadmin -- cross-site request forgery vulnerability
php5 -- potential magic_quotes_gpc vulnerability
wordpress -- header rss feed script insertion vulnerability
openfire -- multiple vulnerabilities
vlc -- cue processing stack overflow
emacs -- run-python vulnerability
opera -- multiple vulnerabilities
opera -- multiple vulnerabilities
2010-04-26 joomla -- multiple vulnerabilities
2010-04-24 moodle -- multiple vulnerabilities
tomcat -- information disclosure vulnerability
2010-04-21 krb5 -- KDC double free vulnerability
2010-04-20 e107 -- code execution and XSS vulnerabilities
fetchmail -- denial of service vulnerability
pidgin -- multiple remote denial of service vulnerabilities
png -- libpng decompression denial of service
2010-04-19 ejabberd -- queue overload denial of service vulnerability
curl -- libcurl buffer overflow vulnerability
irssi -- multiple vulnerabilities
2010-04-18 krb5 -- remote denial of service vulnerability
mahara -- sql injection vulnerability
2010-04-15 sudo -- Privilege escalation with sudoedit
2010-04-14 KDM -- local privilege escalation vulnerability
2010-04-06 Zend Framework -- security issues in bundled Dojo library
dojo -- cross-site scripting and other vulnerabilities
2010-04-05 firefox -- Re-use of freed object due to scope confusion
2010-03-30 mozilla -- multiple vulnerabilities
2010-03-25 postgresql -- bitsubstr overflow
2010-03-24 gtar -- buffer overflow in rmt client
2010-03-23 firefox -- WOFF heap corruption due to integer overflow
2010-03-22 zgv, xzgv -- heap overflow vulnerability
2010-03-19 mozilla -- multiple vulnerabilities
2010-03-11 egroupware -- two vulnerabilities
2010-03-08 drupal -- multiple vulnerabilities
2010-03-01 sudo -- Privilege escalation with sudoedit
2010-02-28 mozilla -- multiple vulnerabilities
2010-02-27 openoffice.org -- multiple vulnerabilities
2010-02-16 lighttpd -- denial of service vulnerability
2010-02-13 linux-flashplugin -- multiple vulnerabilities
gnome-screensaver -- Multiple monitor hotplug issues
2010-02-12 fetchmail -- heap overflow on verbose X.509 display
2010-02-10 wireshark -- LWRES vulnerability
2010-02-03 apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long)
2010-02-01 bugzilla -- information leak
2010-01-28 irc-ratbox -- multiple vulnerabilities
2010-01-21 mozilla -- multiple vulnerabilities
2010-01-11 Zend Framework -- multiple vulnerabilities
2010-01-09 powerdns-recursor -- multiple vulnerabilities
2010-01-04 PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection
2009-12-21 fuser -- missing user's privileges check
monkey -- improper input validation vulnerability
2009-12-17 postgresql -- multiple vulnerabilities
php -- multiple vulnerabilities
tptest -- pwd Remote Stack Buffer Overflow
2009-12-14 freeradius -- remote packet of death vulnerability
mozilla -- multiple vulnerabilities
2009-12-12 mozilla -- multiple vulnerabilities
mozilla -- multiple vulnerabilities
firefox -- multiple vulnerabilities
mozilla -- multiple vulnerabilities
firefox -- javascript garbage collector vulnerability
mozilla -- multiple vulnerabilities
mozilla -- multiple vulnerabilities
2009-12-10 dovecot -- Insecure directory permissions
2009-12-09 linux-flashplugin -- multiple vulnerabilities
rt -- Session fixation vulnerability
ruby -- heap overflow vulnerability
2009-12-08 expat2 -- Parser crash with specially formatted UTF-8 sequences
expat2 -- buffer over-read and crash
2009-11-24 libvorbis -- multiple vulnerabilities
2009-11-23 bugzilla -- information leak
2009-11-06 p5-HTML-Parser -- denial of service
2009-11-05 typo3 -- multiple vulnerabilities in TYPO3 Core
2009-11-03 vlc -- stack overflow in MPA, AVI and ASF demuxer
2009-11-02 KDE -- multiple vulnerabilities
2009-10-29 opera -- multiple vulnerabilities
2009-10-28 Enhanced cTorrent -- stack-based overflow
2009-10-25 elinks -- buffer overflow vulnerability
2009-10-20 Xpdf -- Multiple Vulnerabilities
2009-10-13 phpmyadmin -- XSS and SQL injection vulnerabilities
2009-10-12 php5 -- Multiple security issues
2009-10-06 FreeBSD -- Devfs / VFS NULL pointer race condition
FreeBSD -- kqueue pipe race conditions
2009-10-01 pango -- integer overflow
2009-09-30 mybb -- multiple vulnerabilities
2009-09-22 drupal -- multiple vulnerabilities
horde-base -- multiple vulnerabilities
2009-09-17 bugzilla -- two SQL injections, sensitive data exposure
2009-09-15 nginx -- remote denial of service vulnerability
2009-09-14 cyrus-imapd -- Potential buffer overflow in Sieve
2009-09-13 ikiwiki -- insufficient blacklisting in teximg plugin
xapian-omega -- cross-site scripting vulnerability
2009-09-10 mozilla firefox -- multiple vulnerabilities
2009-09-08 silc-toolkit -- Format string vulnerabilities
2009-09-04 mozilla -- multiple vulnerabilities
2009-09-02 dnsmasq -- TFTP server remote code injection vulnerability
2009-08-25 apache22 -- several vulnerabilities
2009-08-20 pidgin -- MSN overflow parsing SLP messages
2009-08-17 GnuTLS -- multiple vulnerabilities
GnuTLS -- improper SSL certificate verification
memcached -- memcached stats maps Information Disclosure Weakness
2009-08-13 fetchmail -- improper SSL certificate subject verification
2009-08-11 joomla15 -- com_mailto Timeout Issue
2009-08-07 subversion -- heap overflow vulnerability
2009-08-06 squid -- several remote denial of service vulnerabilities
2009-08-05 bugzilla -- product name information leak
2009-08-04 BIND -- Dynamic update message remote DoS
2009-08-02 SquirrelMail -- Plug-ins compromise
2009-07-29 mono -- XML signature HMAC truncation spoofing
2009-07-21 isc-dhcp-client -- Stack overflow vulnerability
2009-07-13 nagios -- Command Injection Vulnerability
2009-07-03 nfsen -- remote command execution
2009-07-01 syslog-ng2 -- startup directory leakage in the chroot environment
2009-06-23 tor-devel -- DNS resolution vulnerabiliity
2009-06-16 cscope -- multiple buffer overflows
cscope -- buffer overflow
pidgin -- multiple vulnerabilities
2009-06-08 apr -- multiple vulnerabilities
2009-05-30 eggdrop -- denial of service vulnerability
slim -- local disclosure of X authority magic cookie
libsndfile -- multiple vulnerabilities
2009-05-22 imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability
nsd -- buffer overflow vulnerability
2009-05-20 ntp -- stack-based buffer overflow
2009-05-17 libxine -- multiple vulnerabilities
libxine -- multiple vulnerabilities
2009-05-16 moinmoin -- cross-site scripting vulnerabilities
libwmf -- embedded GD library Use-After-Free vulnerability
libwmf -- integer overflow vulnerability
mod_perl -- cross-site scripting
drupal -- cross-site scripting
2009-05-15 cyrus-sasl -- buffer overflow vulnerability
2009-05-13 moinmoin -- multiple cross site scripting vulnerabilities
ghostscript -- buffer overflow vulnerability
wireshark -- multiple vulnerabilities
FreeBSD -- remotely exploitable crash in OpenSSL
cups -- remote code execution and DNS rebinding
2009-05-07 quagga -- Denial of Service
2009-04-29 xpdf -- stack based buffer overflow
2009-04-18 poppler -- Poppler Multiple Vulnerabilities
xpdf -- multiple vulnerabilities
freetype2 -- multiple vulnerabilities
2009-04-17 ejabberd -- cross-site scripting vulnerability
2009-04-15 ziproxy -- multiple vulnerability
2009-03-27 pivot-weblog -- file deletion vulnerability
2009-03-26 roundcube -- webmail script insertion and php code injection
2009-03-23 amarok -- multiple vulnerabilities
zabbix -- php frontend multiple vulnerabilities
net-snmp -- DoS for SNMP agent via crafted GETBULK request
2009-03-22 zope -- cross-site scripting vulnerability
2009-03-20 tor -- multiple vulnerabilites
2009-03-18 netatalk -- arbitrary command execution in papd daemon
2009-03-16 libsndfile -- CAF processing integer overflow vulnerability
gstreamer-plugins-good -- multiple memory overflows
ffmpeg -- 4xm processing memory corruption vulnerability
proftpd -- multiple sql injection vulnerabilities
php-mbstring -- php mbstring buffer overflow vulnerability
phppgadmin -- directory traversal with register_globals enabled
2009-03-11 epiphany -- untrusted search path vulnerability
apache -- Cross-site scripting vulnerability
2009-03-04 pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability
curl -- cURL/libcURL Location: Redirect URLs Security Bypass
2009-02-22 lighttpd -- multiple vulnerabilities
2009-02-18 Zend Framework -- Local File Inclusion vulnerability in Zend_View::render()
2009-02-17 dia -- remote command execution vulnerability
2009-02-15 pycrypto -- ARC2 module buffer overflow
varnish -- Varnish HTTP Request Parsing Denial of Service
2009-02-11 pyblosxom -- atom flavor multiple XML injection vulnerabilities
codeigniter -- arbitrary script execution in the new Form Validation class
2009-02-10 squid -- remote denial of service vulnerability
2009-02-09 phplist -- local file inclusion vulnerability
amaya -- multiple buffer overflow vulnerabilities
websvn -- multiple vulnerabilities
ruby -- DNS spoofing vulnerability
2009-02-06 sudo -- certain authorized users could run commands as any user
2009-02-04 drupal -- multiple vulnerabilities
php5-gd -- uninitialized memory information disclosure vulnerability
2009-02-03 perl -- Directory Permissions Race Condition
2009-01-30 moinmoin -- multiple cross site scripting vulnerabilities
ganglia -- buffer overflow vulnerability
2009-01-28 glpi -- SQL Injection
2009-01-23 apache -- mod_imap cross-site scripting flaw
apache -- http request smuggling
2009-01-21 ipset-tools -- Denial of Service Vulnerabilities
2009-01-20 Teamspeak Server -- Directory Traversal Vulnerability
2009-01-19 optipng -- arbitrary code execution via crafted BMP image
git -- gitweb privilege escalation
2009-01-15 gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability
mplayer -- vulnerability in STR files processor
nagios -- web interface privilege escalation vulnerability
2009-01-13 cgiwrap -- XSS Vulnerability
2009-01-11 mysql -- privilege escalation and overwrite of the system table information
pdfjam -- insecure temporary files
mysql -- empty bit-string literal denial of service
verlihub -- insecure temporary file usage and arbitrary command execution
mysql -- remote dos via malformed password packet
mysql -- renaming of arbitrary tables by authenticated users
libcdaudio -- remote buffer overflow and code execution
2009-01-06 xterm -- DECRQSS remote command execution vulnerability
2009-01-05 FreeBSD -- arc4random(9) predictable sequence vulnerability
FreeBSD -- IPv6 Neighbor Discovery Protocol routing vulnerability
FreeBSD -- netgraph / bluetooth privilege escalation
FreeBSD -- Cross-site request forgery in ftpd(8)
2009-01-04 awstats -- multiple XSS vulnerabilities
2009-01-03 p5-File-Path -- rmtree allows creation of setuid files
2009-01-02 vim -- multiple vulnerabilities in the netrw module
2008-12-30 twiki -- multiple vulnerabilities
roundcube -- remote execution of arbitrary code
mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths
mplayer -- twinvq processing buffer overflow vulnerability
2008-12-26 ampache -- insecure temporary file usage
2008-12-25 cups -- potential buffer overflow in PNG reading code
2008-12-19 mediawiki -- multiple vulnerabilities
opera -- multiple vulnerabilities
mozilla -- multiple vulnerabilities
2008-12-07 php -- multiple vulnerabilities
wireshark -- SMTP Processing Denial of Service Vulnerability
mgetty+sendfax -- symlink attack via insecure temporary files
dovecot-managesieve -- Script Name Directory Traversal Vulnerability
habari -- Cross-Site Scripting Vulnerability
vlc -- arbitrary code execution in the RealMedia processor
2008-12-06 mantis -- php code execution vulnerability
mantis -- multiple vulnerabilities
2008-12-04 squirrelmail -- Cross site scripting vulnerability
2008-11-29 openoffice -- arbitrary code execution vulnerabilities
samba -- potential leakage of arbitrary memory contents
hplip -- hpssd Denial of Service
2008-11-24 imlib2 -- XPM processing buffer overflow vulnerability
2008-11-23 streamripper -- multiple buffer overflows
mozilla -- multiple vulnerabilities
2008-11-22 mantis -- session hijacking vulnerability
2008-11-19 dovecot -- ACL plugin bypass vulnerabilities
libxml2 -- multiple vulnerabilities
2008-11-18 enscript -- arbitrary code execution vulnerability
2008-11-16 gnutls -- X.509 certificate chain validation vulnerability
2008-11-13 faad2 -- heap overflow vulnerability
2008-11-10 clamav -- off-by-one heap overflow in VBA project parser
2008-11-09 trac -- potential DOS vulnerability
2008-11-02 qemu -- Heap overflow in Cirrus emulation
2008-10-31 phpmyadmin -- Cross-Site Scripting Vulnerability
2008-10-27 libspf2 -- Buffer overflow
2008-10-25 openx -- sql injection vulnerability
flyspray -- multiple vulnerabilities
2008-10-24 wordpress -- snoopy "_httpsrequest()" shell command execution vulnerability
2008-10-20 libxml2 -- two vulnerabilities
2008-10-19 libxine -- denial of service vulnerability
2008-10-17 linux-flashplugin -- multiple vulnerabilities
2008-10-10 cups -- multiple vulnerabilities
mysql -- command line client input validation vulnerability
mysql -- MyISAM table privileges security bypass vulnerability
2008-10-03 bitlbee -- account recreation security issues
phpmyadmin -- Cross-Site Scripting Vulnerability
gallery -- multiple vulnerabilities
horde -- multiple vulnerabilities
tikiwiki -- multiple vulnerabilities
2008-10-02 mplayer -- multiple integer overflows
2008-09-26 samba -- buffer overflow vulnerability
samba -- multiple vulnerabilities
samba -- nss_info plugin privilege escalation vulnerability
samba -- multiple vulnerabilities
samba -- integer overflow vulnerability
smbd -- buffer-overrun vulnerability
samba -- potential remote DoS vulnerability
samba -- remote file disclosure
samba3 DoS attack
Multiple Potential Buffer Overruns in Samba
2008-09-23 squirrelmail -- Session hijacking vulnerability
2008-09-17 phpmyadmin -- cross site request forgery vulnerabilites
phpmyadmin -- Shared Host Information Disclosure
phpmyadmin -- Username/Password Session File Information Disclosure
2008-09-14 twiki -- Arbitrary code execution in session files
2008-09-12 neon -- NULL pointer dereference in Digest domain support
clamav -- CHM Processing Denial of Service
2008-09-10 python -- multiple vulnerabilities
2008-09-08 Nagios -- Cross Site Scripting Vulnerability
2008-09-05 FreeBSD -- nmount(2) local arbitrary code execution
FreeBSD -- Remote kernel panics on IPv6 connections
FreeBSD -- amd64 swapgs local privilege escalation
2008-09-04 php -- input validation error in safe_mode
2008-08-21 gnutls -- "gnutls_handshake()" Denial of Service
2008-08-20 joomla -- flaw in the reset token validation
2008-08-07 openvpn-devel -- arbitrary code execution
2008-08-04 kdewebdev -- kommander untrusted code execution vulnerability
2008-07-13 FreeBSD -- DNS cache poisoning
2008-07-09 poppler -- uninitialized pointer
2008-07-04 py-pylons -- Path traversal bug
2008-07-03 FreeType 2 -- Multiple Vulnerabilities
2008-07-01 fetchmail -- potential crash in -v -v verbose mode (revised patch)
2008-06-28 squid -- SNMP module denial-of-service vulnerability
2008-06-24 apache -- multiple vulnerabilities
2008-06-21 vim -- Vim Shell Command Injection Vulnerabilities
ruby -- multiple integer and buffer overflow vulnerabilities
mozilla -- multiple vulnerabilities
2008-06-20 fetchmail -- potential crash in -v -v verbose mode
2008-06-15 xorg -- multiple vulnerabilities
moinmoin -- superuser privilege escalation
2008-06-13 Courier Authentication Library -- SQL Injection
2008-06-01 ikiwiki -- cleartext passwords
2008-05-30 linux-flashplugin -- unspecified remote code execution vulnerability
2008-05-21 peercast -- arbitrary code execution
2008-05-17 libvorbis -- various security issues
2008-05-11 vorbis-tools -- Speex header processing vulnerability
2008-05-08 qemu -- "drive_init()" Disk Format Security Bypass
2008-05-07 swfdec -- exposure of sensitive information
2008-05-02 mt-daapd -- integer overflow
sdl_image -- buffer overflow vulnerabilities
php -- integer overflow vulnerability
2008-04-29 gnupg -- memory corruption vulnerability
png -- unknown chunk processing uninitialized memory access
2008-04-28 python -- Integer Signedness Error in zlib Module
2008-04-25 extman -- password bypass vulnerability
mailman -- script insertion vulnerability
mksh -- TTY attachment privilege escalation
serendipity -- multiple cross site scripting vulnerabilities
openfire -- unspecified denial of service
2008-04-24 postgresql -- multiple vulnerabilities
libxine -- array index vulnerability
2008-04-15 clamav -- Multiple Vulnerabilities
2008-04-13 lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability
2008-04-06 postfix-policyd-weight -- working directory symlink vulnerability
2008-04-05 powerdns-recursor -- DNS cache poisoning
2008-03-26 silc -- pkcs_decode buffer overflow
2008-03-20 bzip2 -- crash with certain malformed archive files
2008-03-11 qemu -- unchecked block read/write vulnerability
2008-03-10 dovecot -- security hole in blocking passdbs
2008-03-06 mplayer -- multiple vulnerabilities
2008-03-05 ghostscript -- zseticcspace() function buffer overflow vulnerability
2008-02-29 pcre -- buffer overflow vulnerability
2008-02-27 up-imapproxy -- multiple vulnerabilities
2008-02-26 libxine -- buffer overflow vulnerability
moinmoin -- multiple vulnerabilities
2008-02-25 coppermine -- multiple vulnerabilities
2008-02-22 openldap -- modrdn Denial of Service vulnerability
2008-02-15 clamav -- ClamAV libclamav PE File Integer Overflow Vulnerability
2008-02-13 xfce -- multiple vulnerabilities
2008-02-12 cacti -- Multiple security vulnerabilities have been discovered
claws-mail -- insecure temporary file creation
2008-02-09 zenphoto -- XSS vulnerability
2008-02-04 jetty -- multiple vulnerability
2008-01-31 dircproxy -- remote denial of service
2008-01-29 libxine -- buffer overflow vulnerability
2008-01-23 xorg -- multiple vulnerabilities
2008-01-20 freeradius -- sql injection and denial of service vulnerability
2008-01-19 IRC Services-- Denial of Service Vulnerability
libxine -- buffer overflow vulnerability
2008-01-15 geeklog xss vulnerability
2008-01-14 php -- multiple vulnerabilities
2008-01-10 maradns -- CNAME record resource rotation denial of service
2008-01-07 lsh -- multiple vulnerabilities
2008-01-04 linux-realplayer -- multiple vulnerabilities
2008-01-03 linux-flashplugin -- multiple vulnerabilities
2007-12-29 dovecot -- Specific LDAP + auth cache configuration may mix up user logins
opera -- multiple vulnerabilities
2007-12-22 wireshark -- multiple vulnerabilities
2007-12-20 e2fsprogs -- heap buffer overflow
2007-12-18 ganglia-webfrontend -- XSS vulnerabilities
2007-12-14 qemu -- Translation Block Local Denial of Service Vulnerability
firefox -- multiple remote unspecified memory corruption vulnerabilities
mozilla -- code execution via Quicktime media-link files
2007-12-12 drupal -- SQL injection vulnerability
smbftpd -- format string vulnerability
2007-12-10 jetty -- multiple vulnerabilities
2007-12-09 liveMedia -- DoS vulnerability
2007-12-07 Squid -- Denial of Service Vulnerability
2007-12-05 GNU finger vulnerability
2007-12-01 rubygem-rails -- JSON XSS vulnerability
2007-11-27 rubygem-rails -- session-fixation vulnerability
ikiwiki -- improper symlink verification vulnerability
2007-11-17 postnuke -- admin section SQL injection
2007-11-16 php -- multiple security vulnerabilities
jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented
2007-11-14 net-snmp -- denial of service via GETBULK request
xpdf -- multiple remote Stream.CC vulnerabilities
2007-11-13 flac -- media file processing integer overflow vulnerabilities
2007-11-12 mt-daapd -- denial of service vulnerability
plone -- unsafe data interpreted as pickles
cups -- off-by-one buffer overflow
2007-11-11 gftp -- multiple vulnerabilities
2007-11-09 gallery2 -- multiple vulnerabilities
2007-11-07 perl -- regular expressions unicode data buffer overflow
perl -- vulnerabilities in PERLIO_DEBUG handling
perl -- File::Path insecure file/directory permissions
2007-11-06 pcre -- arbitrary code execution
2007-11-05 perdition -- str_vwrite format string vulnerability
2007-11-01 wordpress -- cross-site scripting
2007-10-31 openldap -- multiple remote denial of service vulnerabilities
mod_jk -- information disclosure
2007-10-27 py-django -- denial of service vulnerability
2007-10-25 opera -- multiple vulnerabilities
2007-10-24 drupal --- multiple vulnerabilities
2007-10-23 ldapscripts -- Command Line User Credentials Disclosure
firefox -- OnUnload Javascript browser entrapment vulnerability
2007-10-20 phpmyadmin -- cross-site scripting vulnerability
2007-10-16 phpmyadmin -- cross site scripting vulnerability
2007-10-11 nagios-plugins -- Long Location Header Buffer Overflow Vulnerability
png -- multiple vulnerabilities
2007-10-10 ImageMagick -- multiple vulnerabilities
mediawiki -- cross site scripting vulnerability
2007-10-08 xfs -- multiple vulnerabilites
2007-10-04 firebird -- multiple remote buffer overflow vulnerabilities
2007-10-01 id3lib -- insecure temporary file creation
2007-09-21 wordpress -- remote sql injection vulnerability
clamav -- multiple remote Denial of Service vulnerabilities
bugzilla -- multiple vulnerabilities
2007-09-20 openoffice -- arbitrary command execution vulnerability
2007-09-19 konquerer -- address bar spoofing
kdm -- passwordless login vulnerability
flyspray -- authentication bypass
2007-09-11 apache -- multiple vulnerabilities
2007-09-10 lighttpd -- FastCGI header overrun in mod_fastcgi
2007-09-05 rkhunter -- insecure temporary file creation
2007-09-02 fetchmail -- denial of service on reject of local warning message
2007-09-01 gtar -- Directory traversal vulnerability
2007-08-25 opera -- Vulnerability in javascript handling
2007-08-23 rsync -- off by one stack overflow
2007-08-16 wordpress -- unmoderated comments disclosure
2007-08-10 flac123 -- stack overflow in comment parsing
2007-08-02 fsplib -- multiple vulnerabilities
FreeBSD -- Buffer overflow in tcpdump(1)
FreeBSD -- Predictable query ids in named(8)
FreeBSD -- heap overflow in file(1)
FreeBSD -- Jail rc.d script privilege escalation
2007-08-01 phpsysinfo -- url Cross-Site Scripting
2007-07-29 mutt -- buffer overflow vulnerability
2007-07-28 p5-Net-DNS -- multiple Vulnerabilities
drupal -- Cross site request forgeries
drupal -- Multiple cross-site scripting vulnerabilities
2007-07-27 vim -- Command Format String Vulnerability
2007-07-26 libvorbis -- Multiple memory corruption flaws
2007-07-24 tomcat -- XSS vulnerability in sample applications
tomcat -- multiple vulnerabilities
dokuwiki -- XSS vulnerability in spellchecker backend
2007-07-18 linux-flashplugin -- critical vulnerabilities
2007-07-09 typespeed -- arbitrary code execution
2007-06-29 gd -- multiple vulnerabilities
2007-06-28 evolution-data-server -- remote execution of arbitrary code vulnerability
2007-06-27 mod_perl -- remote DoS in PATH_INFO parsing
2007-06-24 wordpress -- XMLRPC SQL Injection
2007-06-21 xpcd -- buffer overflow
2007-06-19 clamav -- multiple vulnerabilities
2007-06-18 p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability
2007-06-12 cups -- Incomplete SSL Negotiation Denial of Service
2007-06-07 mplayer -- cddb stack overflow
2007-06-05 gzip -- multiple vulnerabilities
2007-06-04 typo3 -- email header injection
2007-06-01 findutils -- GNU locate heap buffer overrun
2007-05-24 FreeType 2 -- Heap overflow vulnerability
2007-05-21 squirrelmail -- Cross site scripting in HTML filter
2007-05-16 png -- DoS crash vulnerability
2007-05-02 qemu -- several vulnerabilities
2007-04-28 FreeBSD -- IPv6 Routing Header 0 is dangerous
2007-04-23 gnupg -- OpenPGP symmetric encryption vulnerability
2007-04-19 claws-mail -- APOP vulnerability
mozilla -- multiple vulnerabilities
2007-04-14 lighttpd -- DOS when access files with mtime 0
lighttpd -- Remote DOS in CRLF parsing
2007-04-13 google-earth -- heap overflow in the KML engine
2007-04-09 fetchmail -- insecure APOP authentication
2007-04-08 mcweject -- exploitable buffer overflow
WebCalendar -- "noSet" variable overwrite vulnerability
2007-03-16 sql-ledger -- security bypass vulnerability
samba -- potential Denial of Service bug in smbd
samba -- format string bug in afsacl.so VFS plugin
tdiary -- injection vulnerability
2007-03-14 ktorrent -- multiple vulnerabilities
2007-03-09 mplayer -- DMO File Parsing Buffer Overflow Vulnerability
trac -- cross site scripting vulnerability
2007-03-06 mod_jk -- long URL stack overflow vulnerability
2007-02-27 bind -- Multiple Denial of Service vulnerabilities
gtar -- name mangling symlink vulnerability
FreeBSD -- Kernel memory disclosure in firewire(4)
2007-02-26 libarchive -- Infinite loop in corrupt archives handling in libarchive
OpenSSL -- Multiple problems in crypto(3)
2007-02-21 snort -- DCE/RPC preprocessor vulnerability
2007-02-17 rar -- password prompt buffer overflow vulnerability
2007-01-17 joomla -- multiple remote vulnerabilities
2007-01-15 sircd -- remote reverse DNS buffer overflow
sircd -- remote operator privilege escalation vulnerability
2007-01-12 cacti -- Multiple vulnerabilities
2007-01-08 mplayer -- buffer overflow in the code for RealMedia RTSP streams.
2007-01-06 fetchmail -- crashes when refusing a message bound for an MDA
fetchmail -- TLS enforcement problem/MITM attack/password exposure
2007-01-03 w3m -- format string vulnerability
2006-12-27 plone -- user can masquerade as a group
zope -- restructuredText "csv_table" Information Disclosure
2006-12-24 phpbb -- NULL byte injection vulnerability
2006-12-21 proftpd -- remote code execution vulnerabilities
2006-12-19 bind9 -- Denial of Service in named(8)
openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)
2006-12-18 sql-ledger -- multiple vulnerabilities
2006-12-15 gnupg -- remotely controllable function pointer
unzoo -- Directory Traversal Vulnerability
ruby -- cgi.rb library Denial of Service
2006-12-14 evince -- Buffer Overflow Vulnerability
dbus -- match_rule_equal() Weakness
2006-12-13 wv -- Multiple Integer Overflow Vulnerabilities
wv2 -- Integer Overflow Vulnerability
2006-12-09 libxine -- multiple buffer overflow vulnerabilities
2006-12-02 libmusicbrainz -- multiple buffer overflow vulnerabilities
ImageMagick -- SGI Image File heap overflow vulnerability
2006-11-30 gtar -- GNUTYPE_NAMES directory traversal vulnerability
kronolith -- arbitrary local file inclusion vulnerability
2006-11-27 gnupg -- buffer overflow
2006-11-15 proftpd -- Remote Code Execution Vulnerability
awstats -- arbitrary command execution vulnerability
2006-11-11 bugzilla -- multiple vulnerabilities
bugzilla -- multiple vulnerabilities
2006-11-08 Imlib2 -- multiple image file processing vulnerabilities
cvsbug -- race condition
2006-11-02 mozilla -- multiple vulnerabilities
mozilla -- multiple vulnerabilities
2006-11-01 apache -- mod_rewrite buffer overflow vulnerability
2006-10-30 mysql -- database suid privilege escalation
2006-10-29 screen -- combined UTF-8 characters vulnerability
mysql -- database "case-sensitive" privilege escalation
2006-10-22 kdelibs -- integer overflow in khtml
2006-10-21 Serendipity -- XSS Vulnerabilities
nvidia-driver -- arbitrary root code execution vulnerability
2006-10-20 opera -- URL parsing heap overflow vulnerability
asterisk -- remote heap overwrite vulnerability
plone -- unprotected MembershipTool methods
2006-10-18 drupal -- HTML attribute injection
drupal -- cross site request forgeries
drupal -- multiple XSS vulnerabilities
2006-10-17 win32-codecs -- multiple vulnerabilities
2006-10-16 clamav -- CHM unpacker and PE rebuilding vulnerabilities
2006-10-15 tkdiff -- temporary file symlink privilege escalation
vtiger -- multiple remote file inclusion vulnerabilities
torrentflux -- User-Agent XSS Vulnerability
MT -- Search Unspecified XSS
plans -- multiple vulnerabilities
eyeOS -- multiple XSS security bugs
2006-10-11 cscope -- Buffer Overflow Vulnerabilities
2006-10-08 python -- buffer overrun in repr() for unicode strings
python -- SimpleXMLRPCServer.py allows unrestricted traversal
2006-10-05 tin -- buffer overflow vulnerabilities
openldap -- slapd acl selfwrite Security Issue
mono -- "System.CodeDom.Compiler" Insecure Temporary Creation
mambo -- SQL injection vulnerabilities
curl -- TFTP packet buffer overflow vulnerability
lynx -- remote buffer overflow
2006-10-04 mailman -- Multiple Vulnerabilities
2006-10-03 phpmyadmin -- XSRF vulnerabilities
2006-10-02 freetype -- LWFN Files Buffer Overflow Vulnerability
gnutls -- RSA Signature Forgery Vulnerability
dokuwiki -- multiple vulnerabilities
dokuwiki -- multiple vulnerabilities
2006-10-01 gtetrinet -- remote code execution
2006-09-30 openssh -- multiple vulnerabilities
tikiwiki -- multiple vulnerabilities
punbb -- NULL byte injection vulnerability
2006-09-26 freeciv -- Denial of Service Vulnerabilities
freeciv -- Packet Parsing Denial of Service Vulnerability
unace -- multiple vulnerabilities
2006-09-22 libmms -- stack-based buffer overflow
opera -- RSA Signature Forgery
2006-09-12 linux-flashplugin7 -- arbitrary code execution vulnerabilities
tomcat -- Tomcat Manager cross-site scripting
jdk -- jar directory traversal vulnerability
2006-09-03 fd_set -- bitmap index overflow in multiple applications
2006-08-30 sppp -- buffer overflow vulnerability
2006-08-17 horde -- Phishing and Cross-Site Scripting Vulnerabilities
2006-08-15 f2c -- insecure temporary files
2006-08-13 x11vnc -- authentication bypass vulnerability
postgresql -- encoding based SQL injection
mysql -- format string vulnerability
postgresql -- multiple vulnerabilities
postgresql81-server -- SET ROLE privilege escalation
2006-08-12 squirrelmail -- random variable overwrite vulnerability
2006-08-10 rubygem-rails -- evaluation of ruby code
2006-08-08 clamav -- heap overflow vulnerability
drupal -- XSS vulnerability
2006-08-02 gnupg -- 2 more possible memory allocation attacks
2006-07-30 ruby -- multiple vulnerabilities
2006-07-14 zope -- information disclosure vulnerability
drupal -- multiple vulnerabilities
2006-07-11 shoutcast -- cross-site scripting, information exposure
2006-07-10 samba -- memory exhaustion DoS in smbd
twiki -- multiple file extensions file upload vulnerability
2006-07-02 webmin, usermin -- arbitrary file disclosure vulnerability
2006-06-30 mutt -- Remote Buffer Overflow Vulnerability
Joomla -- multiple vulnerabilities
2006-06-27 hashcash -- heap overflow vulnerability
2006-06-25 gnupg -- user id integer overflow vulnerability
2006-06-17 horde -- multiple parameter cross site scripting vulnerabilities
WebCalendar -- information disclosure vulnerability
2006-06-14 sendmail -- Incorrect multipart message handling
2006-06-12 dokuwiki -- multiple vulnerabilities
2006-06-11 libxine -- buffer overflow vulnerability
2006-06-09 ypserv -- Inoperative access controls in ypserv
smbfs -- chroot escape
FreeBSD -- FPU information disclosure
sendmail -- race condition vulnerability
OPIE -- arbitrary password change
ipsec -- reply attack vulnerability
openssh -- remote denial of service
nfs -- remote denial of service
FreeBSD -- Infinite loop in SACK handling
pf -- IP fragment handling panic
FreeBSD -- Local kernel memory disclosure
ipfw -- IP fragment denial of service
IEEE 802.11 -- buffer overflow
2006-06-08 freeradius -- multiple vulnerabilities
freeradius -- authentication bypass vulnerability
tiff -- buffer overflow vulnerability
opera -- image dragging vulnerability
tiff -- divide-by-zero denial-of-service
tiff -- directory entry count integer overflow vulnerability
tiff -- multiple integer overflows
tiff -- RLE decoder heap overflows
2006-06-06 squirrelmail -- plugin.php local file inclusion vulnerability
2006-06-05 dokuwiki -- spellchecker remote PHP code execution
drupal -- multiple vulnerabilities
2006-06-01 MySQL -- SQL-injection security vulnerability
MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities
2006-05-23 cscope -- buffer overflow vulnerabilities
frontpage -- cross site scripting vulnerability
2006-05-22 coppermine -- "file" Local File Inclusion Vulnerability
coppermine -- Multiple File Extensions Vulnerability
coppermine -- File Inclusion Vulnerabilities
2006-05-21 phpmyadmin -- XSRF vulnerabilities
2006-05-18 vnc -- authentication bypass vulnerability
2006-05-14 phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities
2006-05-11 p5-DBI -- insecure temporary file creation vulnerability
2006-05-06 fswiki -- XSS vulnerability
mysql50-server -- COM_TABLE_DUMP arbitrary code execution
2006-05-05 firefox -- denial of service vulnerability
2006-05-03 phpwebftp -- "language" Local File Inclusion
clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability
2006-05-02 trac -- Wiki Macro Script Insertion Vulnerability
2006-05-01 jabberd -- SASL Negotiation Denial of Service Vulnerability
2006-04-27 cacti -- ADOdb "server.php" Insecure Test Script Security Issue
amaya -- Attribute Value Buffer Overflow Vulnerabilities
lifetype -- ADOdb "server.php" Insecure Test Script Security Issue
ethereal -- Multiple Protocol Dissector Vulnerabilities
mozilla -- multiple vulnerabilities
2006-04-25 asterisk -- denial of service vulnerability, local system access
2006-04-23 crossfire-server -- denial of service and remote code execution vulnerability
wordpress -- full path disclosure
xine -- multiple remote string vulnerabilities
2006-04-22 cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service
2006-04-18 plone -- "member_id" Parameter Portrait Manipulation Vulnerability
2006-04-16 mailman -- Private Archive Script Cross-Site Scripting
heartbeat -- insecure temporary file creation vulnerability
2006-04-07 mplayer -- Multiple integer overflows
kaffeine -- buffer overflow vulnerability
thunderbird -- javascript execution
phpmyadmin -- XSS vulnerabilities
2006-04-06 phpmyadmin -- 'set_theme' Cross-Site Scripting
clamav -- Multiple Vulnerabilities
zoo -- stack based buffer overflow
openvpn -- LD_PRELOAD code execution on client through malicious or compromised server
2006-04-05 mediawiki -- hardcoded placeholder string security bypass vulnerability
netpbm -- buffer overflow in pnmtopng
mediawiki -- cross site scripting vulnerability
dia -- XFig Import Plugin Buffer Overflow
samba -- Exposure of machine account credentials in winbind log files
mod_pubcookie -- cross site scripting vulnerability
pubcookie-login-server -- cross site scripting vulnerability
2006-03-30 horde -- remote code execution vulnerability in the help viewer
2006-03-29 freeradius -- EAP-MSCHAPv2 Authentication Bypass
2006-03-27 linux-realplayer -- buffer overrun
linux-realplayer -- heap overflow
2006-03-24 evolution -- remote format string vulnerabilities
2006-03-21 xorg-server -- privilege escalation
2006-03-20 heimdal -- Multiple vulnerabilities
2006-03-17 drupal -- multiple vulnerabilities
2006-03-15 horde -- "url" disclosure of sensitive information vulnerability
linux-flashplugin -- arbitrary code execution vulnerability
2006-03-11 GnuPG does not detect injection of unsigned data
2006-03-09 mplayer -- heap overflow in the ASF demuxer
2006-03-06 SSH.COM SFTP server -- format string vulnerability
2006-03-03 gtar -- invalid headers buffer overflow
2006-02-24 squirrelmail -- multiple vulnerabilities
2006-02-20 gedit -- format string vulnerability
WebCalendar -- unauthorized access vulnerability
abiword, koffice -- stack based buffer overflow vulnerabilities
2006-02-17 gnupg -- false positive signature verification
2006-02-16 rssh -- privilege escalation vulnerability
tor -- malicious tor server can locate a hidden service
sudo -- arbitrary command execution
libtomcrypt -- weak signature scheme with ECC keys
mantis -- "view_filters_page.php" cross site scripting vulnerability
phpbb -- multiple vulnerabilities
postgresql -- character conversion and tsearch2 vulnerabilities
2006-02-15 perl, webmin, usermin -- perl format string integer wrap vulnerability
kpdf -- heap based buffer overflow
phpicalendar -- cross site scripting vulnerability
phpicalendar -- file disclosure vulnerability
2006-02-07 kpopup -- local root exploit and local denial of service
2006-01-27 ee -- temporary file privilege escalation
cpio -- multiple vulnerabilities
texindex -- temporary file privilege escalation
2006-01-23 sge -- local root exploit in bundled rsh executable
fetchmail -- crash when bouncing a message
2006-01-15 clamav -- possible heap overflow in the UPX code
2006-01-09 milter-bogom -- headerless message crash
2006-01-07 bogofilter -- heap corruption through excessively long words
bogofilter -- heap corruption through malformed input
2006-01-04 rxvt-unicode -- restore permissions on tty devices
2006-01-02 squid -- possible cache-poisoning via malformed HTTP responses
2006-01-01 curl -- URL buffer overflow vulnerability
2005-12-25 nbd-server -- buffer overflow vulnerability
phpSysInfo -- "register_globals" emulation layer overwrite vulnerability
phpSysInfo -- cross site scripting vulnerability
2005-12-22 scponly -- local privilege escalation exploits
2005-12-19 fetchmail -- null pointer dereference in multidrop mode with headerless email
2005-12-14 mantis -- "t_core_path" file inclusion vulnerability
mantis -- "view_filters_page.php" cross-site scripting vulnerability
2005-12-11 mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields
nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields
turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields
kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields
horde -- Cross site scripting vulnerabilities in several of Horde's templates
2005-12-07 phpmyadmin -- register_globals emulation "import_blacklist" manipulation
ffmpeg -- libavcodec buffer overflow vulnerability
phpmyadmin -- XSS vulnerabilities
trac -- search module SQL injection vulnerability
2005-12-01 drupal -- multiple vulnerabilities
2005-11-30 opera -- multiple vulnerabilities
opera -- command line URL shell command injection
mambo -- "register_globals" emulation layer overwrite vulnerability
2005-11-29 flyspray -- cross-site scripting vulnerabilities
2005-11-28 zope -- expose RestructuredText functionality to untrusted users
2005-11-27 ghostscript -- insecure temporary file creation vulnerability
2005-11-26 horde -- Cross site scripting vulnerabilities in MIME viewers
qpopper -- multiple privilege escalation vulnerabilities
2005-11-16 phpmyadmin -- HTTP Response Splitting vulnerability
2005-11-14 sudo -- local race condition vulnerability
2005-11-13 Macromedia flash player -- swf file handling arbitrary code
2005-11-10 p5-Mail-SpamAssassin -- long message header denial of service
2005-11-08 WebCalendar -- remote file inclusion vulnerability
gallery2 -- file disclosure vulnerability
2005-11-06 ruby -- arbitrary command execution on XMLRPC server
2005-11-04 pear-PEAR -- PEAR installer arbitrary code execution vulnerability
openvpn -- potential denial-of-service on servers in TCP mode
openvpn -- arbitrary code execution on client through malicious or compromised server
2005-11-02 skype -- multiple buffer overflow vulnerabilities
2005-11-01 PHP -- multiple vulnerabilities
squid -- FTP server response handling denial of service
2005-10-31 base -- PHP SQL injection vulnerability
2005-10-30 fetchmail -- fetchmailconf local password exposure
2005-10-27 ruby -- vulnerability in the safe level settings
2005-10-26 firefox & mozilla -- multiple vulnerabilities
firefox & mozilla -- command line URL shell command injection
firefox & mozilla -- buffer overflow vulnerability
net-snmp -- remote DoS vulnerability
2005-10-25 openssl -- potential SSL 2.0 rollback
2005-10-23 xloadimage -- buffer overflows in NIFF image title handling
libgadu -- multiple vulnerabilities
2005-10-22 clamav -- arbitrary code execution and DoS vulnerabilities
2005-10-18 snort -- Back Orifice preprocessor buffer overflow vulnerability
2005-10-13 phpmyadmin -- local file inclusion vulnerability
2005-10-09 libxine -- format string vulnerability
kdebase -- Kate backup file permission leak
2005-10-07 cfengine -- arbitrary file overwriting vulnerability
2005-10-05 imap-uw -- mailbox name handling remote buffer vulnerability
2005-10-02 weex -- remote format string vulnerability
picasm -- buffer overflow vulnerability
squid -- possible denial of service condition regarding NTLM authentication
squid -- Denial Of Service Vulnerability in sslConnectTimeout
squid -- Possible Denial Of Service Vulnerability in store.c
2005-10-01 uim -- privilege escalation vulnerability
zlib -- buffer overflow vulnerability
ProZilla -- server response buffer overflow vulnerabilities
2005-09-29 phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution
2005-09-24 zlib -- buffer overflow vulnerability
2005-09-22 urban -- stack overflow vulnerabilities
2005-09-21 bind -- buffer overrun vulnerability
tor -- diffie-hellman handshake flaw
cups-base -- CUPS server remote DoS vulnerability
2005-09-19 squirrelmail -- _$POST variable handling allows for various attacks
2005-09-17 apache -- Certificate Revocation List (CRL) off-by-one vulnerability
2005-09-15 X11 server -- pixmap allocation vulnerability
2005-09-13 unzip -- permission race vulnerability
htdig -- cross site scripting vulnerability
2005-09-07 xpdf -- disk fill DoS vulnerability
2005-09-04 pear-XML_RPC -- remote PHP code injection vulnerability
2005-09-03 bind9 -- denial of service
2005-08-29 fswiki -- command injection vulnerability
2005-08-28 acroread -- XML External Entity vulnerability
2005-08-27 pam_ldap -- authentication bypass vulnerability
2005-08-26 pcre -- regular expression buffer overflow
2005-08-23 elm -- remote buffer overflow in Expires header
awstats -- arbitrary code execution vulnerability
2005-08-19 openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server
openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory
openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients
openvpn -- denial of service: client certificate validation can disconnect unrelated clients
2005-08-16 acroread -- plug-in buffer overflow vulnerability
2005-08-12 gaim -- AIM/ICQ non-UTF-8 filename crash
gaim -- AIM/ICQ away message buffer overflow
2005-08-09 gforge -- XSS and email flood vulnerabilities
2005-08-08 postnuke -- multiple vulnerabilities
2005-08-05 ipsec -- Incorrect key usage in AES-XCBC-MAC
mambo -- multiple vulnerabilities
devfs -- ruleset bypass
2005-08-03 proftpd -- format string vulnerabilities
2005-08-01 nbsmtp -- format string vulnerability
2005-07-31 sylpheed -- MIME-encoded file name buffer overflow vulnerability
phpmyadmin -- cross site scripting vulnerability
vim -- vulnerabilities in modeline handling: glob, expand
ekg -- insecure temporary file creation
2005-07-30 opera -- download dialog spoofing vulnerability
ethereal -- multiple protocol dissectors vulnerabilities
jabberd -- 3 buffer overflows
2005-07-25 clamav -- multiple remote buffer overflows
2005-07-23 isc-dhcpd -- format string vulnerabilities
egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities
2005-07-22 fetchmail -- denial of service/crash from malicious POP3 server
2005-07-21 PowerDNS -- LDAP backend fails to escape all queries
dnrd -- remote buffer and stack overflow vulnerabilities
fetchmail -- remote root/code injection from malicious POP3 server
phppgadmin -- "formLanguage" local file inclusion vulnerability
2005-07-18 bugzilla -- multiple vulnerabilities
2005-07-16 firefox & mozilla -- multiple vulnerabilities
drupal -- PHP code execution vulnerabilities
2005-07-13 net-snmp -- fixproc insecure temporary file creation
2005-07-09 mysql-server -- insecure temporary file creation
phpbb -- multiple vulnerabilities
shtool -- insecure temporary file creation
2005-07-08 pear-XML_RPC -- information disclosure vulnerabilities
nwclient -- multiple vulnerabilities
2005-07-07 phpbb -- remote PHP code execution vulnerability
2005-07-06 clamav -- cabinet file handling DoS vulnerability
acroread -- insecure temporary file creation
clamav -- MS-Expand file handling DoS vulnerability
acroread -- buffer overflow vulnerability
bzip2 -- denial of service and permission race vulnerabilities
kernel -- ipfw packet matching errors with address tables
kernel -- TCP connection stall denial of service
gzip -- directory traversal and permission race vulnerabilities
2005-07-05 cacti -- multiple vulnerabilities
wordpress -- multiple vulnerabilities
wordpress -- multiple vulnerabilities
2005-07-03 pear-XML_RPC -- arbitrary remote code execution
2005-06-24 ethereal -- multiple protocol dissectors vulnerabilities
tor -- information disclosure
linux-realplayer -- RealText parsing heap overflow
ethereal -- multiple protocol dissectors vulnerabilities
2005-06-21 cacti -- potential SQL injection and cross site scripting attacks
2005-06-20 opera -- XMLHttpRequest security bypass
trac -- file upload/download vulnerability
opera -- "javascript:" URL cross-site scripting vulnerability
opera -- redirection cross-site scripting vulnerability
razor-agents -- denial of service vulnerability
tcpdump -- infinite loops in protocol decoding
2005-06-18 p5-Mail-SpamAssassin -- denial of service vulnerability
squirrelmail -- Several cross site scripting vulnerabilities
2005-06-17 gaim -- Yahoo! remote crash vulnerability
gaim -- MSN Remote DoS vulnerability
gallery -- remote code injection via HTTP_POST_VARS
gallery -- cross-site scripting
kstars -- exploitable set-user-ID application fliccd
2005-06-09 leafnode -- denial of service vulnerability
2005-06-03 gforge -- directory traversal vulnerability
imap-uw -- authentication bypass when CRAM-MD5 is enabled
squid -- denial-of-service vulnerabilities
xloadimage -- arbitrary command execution when handling compressed files
racoon -- remote denial-of-service
xli -- integer overflows in image size calculations
xloadimage -- buffer overflow in FACES image handling
yamt -- buffer overflow and directory traversal issues
2005-06-01 xview -- multiple buffer overflows in xv_parse_one
xtrlock -- X display locking bypass
linux_base -- vulnerabilities in Red Hat 7.1 libraries
squirrelmail -- XSS and remote code injection vulnerabilities
sympa -- buffer overflow in "queue"
mailman -- generated passwords are poor quality
mailman -- password disclosure
fswiki -- XSS problem in file upload form
2005-05-22 ppxp -- local root exploit
oops -- format string vulnerability
2005-05-19 cdrdao -- unspecified privilege escalation vulnerability
squid -- possible abuse of cachemgr.cgi
squid -- DNS lookup spoofing vulnerability
2005-05-14 gaim -- MSN remote DoS vulnerability
gaim -- remote crash on some protocols
2005-05-13 kernel -- information disclosure when using HTT
leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout
leafnode denial-of-service triggered by article request
leafnode fetchnews denial-of-service triggered by missing header
leafnode fetchnews denial-of-service triggered by truncated transmission
2005-05-12 mozilla -- privilege escalation via non-DOM property overrides
mozilla -- "Wrapped" javascript: urls bypass security checks
2005-05-11 mozilla -- code execution via javascript: IconURL vulnerability
2005-05-09 groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files
groff -- groffer uses temporary files unsafely
2005-05-03 gnu-radius -- SNMP-related denial-of-service
2005-05-01 sharutils -- unshar insecure temporary file creation
rsnapshot -- local privilege escalation
coppermine -- IP spoofing and XSS vulnerability
2005-04-27 ImageMagick -- ReadPNMImage() heap overflow vulnerability
jdk/jre -- Security Vulnerability With Java Plugin
2005-04-25 gaim -- AIM/ICQ remote denial of service vulnerability
mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities
gaim -- remote DoS on receiving malformed HTML
2005-04-22 junkbuster -- heap corruption vulnerability and configuration modification vulnerability
kdelibs -- kimgio input validation errors
2005-04-20 openoffice -- DOC document heap overflow vulnerability
2005-04-19 gld -- format string and buffer overflow vulnerabilities
2005-04-17 axel -- remote buffer overflow
2005-04-16 firefox -- PLUGINSPAGE privileged javascript execution
mozilla -- privilege escalation via DOM property overrides
mozilla -- code execution through javascript: favicons
mozilla -- javascript "lambda" replace exposes memory contents
firefox -- arbitrary code execution in sidebar panel
2005-04-15 wget -- multiple vulnerabilities
2005-04-12 portupgrade -- insecure temporary file handling vulnerability
2005-04-10 gaim -- jabber remote crash
gaim -- remote DoS on receiving certain messages over IRC
gaim -- remote DoS on receiving malformed HTML
php -- readfile() DoS vulnerability
squid -- DoS on failed PUT/POST requests vulnerability
2005-04-09 clamav -- zip handling DoS vulnerability
2005-04-05 horde -- Horde Page Title Cross-Site Scripting Vulnerability
cyrus-imapd -- multiple buffer overflow vulnerabilities
2005-04-04 wu-ftpd -- remote globbing DoS vulnerability
2005-04-03 hashcash -- format string vulnerability
2005-03-24 wine -- information disclosure due to insecure temporary file handling
firefox -- arbitrary code execution from sidebar panel
mozilla -- heap buffer overflow in GIF image processing
2005-03-23 sylpheed -- buffer overflow in header processing
2005-03-21 kdelibs -- local DCOP denial of service vulnerability
xv -- filename handling format string vulnerability
2005-03-18 grip -- CDDB response multiple matches buffer overflow vulnerability
2005-03-15 phpmyadmin -- increased privilege vulnerability
quake2 -- multiple critical vulnerabilities
mysql -- ALTER MERGE denial of service vulnerability
mysql -- GRANT access restriction problem
mysql -- mysql_real_connect buffer overflow vulnerability
mysql -- erroneous access restrictions applied to table renames
2005-03-14 mysql-server -- multiple remote vulnerabilities
2005-03-13 rxvt-unicode -- buffer overflow vulnerability
2005-03-08 phpmyadmin -- information disclosure vulnerability
libexif -- buffer overflow vulnerability
phpmyadmin -- arbitrary file include and XSS vulnerabilities
2005-03-07 phpbb -- Insuffient check against HTML code in usercp_register.php
2005-03-05 phpbb -- privilege elevation and path disclosure
2005-03-04 postnuke -- SQL injection vulnerabilities
postnuke -- cross-site scripting (XSS) vulnerabilities
realplayer -- remote heap overflow
2005-03-03 ImageMagick -- format string vulnerability
2005-03-01 uim -- privilege escalation vulnerability
lighttpd -- script source disclosure vulnerability
tiff -- tiffdump integer overflow vulnerability
2005-02-27 curl -- authentication buffer overflow vulnerability
sup -- format string vulnerability
2005-02-26 mozilla -- insecure temporary directory vulnerability
mozilla -- arbitrary code execution vulnerability
web browsers -- window injection vulnerabilities
2005-02-25 phpbb -- multiple information disclosure vulnerabilities
2005-02-24 mkbold-mkitalic -- format string vulnerability
2005-02-23 putty -- pscp/psftp heap corruption vulnerabilities
awstats -- arbitrary command execution
awstats -- remote command execution vulnerability
2005-02-22 mod_dosevasive -- insecure temporary file creation
bnc -- remotely exploitable buffer overflow in getnickuserhost
2005-02-20 kdelibs -- insecure temporary file creation
2005-02-19 postgresql -- multiple buffer overflows in PL/PgSQL parser
2005-02-18 bidwatcher -- format string vulnerability
gftp -- directory traversal vulnerability
opera -- "data:" URI handler spoofing vulnerability
opera -- kfmclient exec command execution vulnerability
2005-02-14 powerdns -- DoS vulnerability
emacs -- movemail format string vulnerability
2005-02-13 ngircd -- buffer overflow vulnerability
ngircd -- format string vulnerability
mod_python -- information leakage vulnerability
squid -- buffer overflow in WCCP recvfrom() call
Open DC Hub -- remote buffer overflow vulnerability
2005-02-12 mailman -- directory traversal vulnerability
2005-02-11 enscript -- multiple vulnerabilities
unrtf -- buffer overflow vulnerability
2005-02-08 postgresql -- privilege escalation vulnerability
ethereal -- multiple protocol dissectors vulnerabilities
squid -- correct handling of oversized HTTP reply headers
squid -- no sanity check of usernames in squid_ldap_auth
squid -- confusing results on empty acl declarations
2005-02-07 squid -- HTTP response splitting cache pollution attack
2005-02-03 xpdf -- makeFileKey2() buffer overflow vulnerability
2005-02-02 evolution -- arbitrary code execution vulnerability
2005-02-01 newsgrab -- insecure file and directory creation
newsgrab -- directory traversal vulnerability
newspost -- server response buffer overflow vulnerability
newsfetch -- server response buffer overflow vulnerability
2005-01-25 zhcon -- unauthorized file access
yamt -- arbitrary command execution vulnerability
2005-01-24 bugzilla -- cross-site scripting vulnerability
opera -- multiple vulnerabilities in Java implementation
phpbb -- arbitrary command execution and other vulnerabilities
2005-01-22 horde -- XSS vulnerabilities
squid -- denial of service with forged WCCP messages
squid -- buffer overflow vulnerability in gopherToHTML
2005-01-21 mc -- multiple vulnerabilities
fcron -- multiple vulnerabilities
realplayer -- arbitrary file deletion and other vulnerabilities
imlib -- xpm heap buffer overflows and integer overflows
egroupware -- arbitrary file download in JiNN
konversation -- shell script command injection
zgv -- exploitable heap overflows
2005-01-19 libxine -- DVD subpicture decoder heap overflow
xshisen -- local buffer overflows
helvis -- arbitrary file deletion problem
helvis -- information leak vulnerabilities
golddig -- local buffer overflow vulnerabilities
a2ps -- insecure temporary file creation
jabberd -- denial-of-service vulnerability
mod_access_referer -- null pointer dereference vulnerability
putty -- buffer overflow vulnerability in ssh2 support
2005-01-18 mozilla -- insecure permissions for some downloaded files
ImageMagick -- PSD handler heap overflow vulnerability
exim -- two buffer overflow vulnerabilities
2005-01-17 cups-lpr -- lppasswd multiple vulnerabilities
cups-base -- HPGL buffer overflow vulnerability
mysql-scripts -- mysqlaccess insecure temporary file creation
2005-01-13 mozilla -- heap overflow in NNTP handler
mpg123 -- buffer overflow vulnerability
tnftp -- mget does not check for directory escapes
vim -- vulnerabilities in modeline handling
mpg123 -- playlist processing buffer overflow vulnerability
greed -- insecure GRX file processing
xpdf -- buffer overflow vulnerability
konqueror -- Password Disclosure for SMB Shares
2005-01-12 libxine -- multiple vulnerabilities in VideoCD handling
libxine -- multiple buffer overflows in RTSP
libxine -- buffer-overflow vulnerability in aiff support
mplayer -- multiple vulnerabilities
2005-01-11 hylafax -- unauthorized login vulnerability
2005-01-08 dillo -- format string vulnerability
2005-01-06 pcal -- buffer overflow vulnerabilities
acroread5 -- mailListIsPdf() buffer overflow vulnerability
acroread uudecoder input validation error
2005-01-04 kdelibs3 -- konqueror FTP command injection vulnerability
2005-01-03 xpm -- image decoding vulnerabilities
2004-12-30 mpg123 -- buffer overflow in URL handling
a2ps -- insecure command line argument handling
2004-12-23 ethereal -- multiple vulnerabilities
2004-12-21 ecartis -- unauthorised access to admin interface
krb5 -- heap buffer overflow vulnerability in libkadm5srv
2004-12-19 phpmyadmin -- command execution vulnerability
phpmyadmin -- file disclosure vulnerability
2004-12-18 php -- multiple vulnerabilities
2004-12-16 mysql -- FTS request denial of service vulnerability
2004-12-12 viewcvs -- information leakage
rssh & scponly -- arbitrary command execution
zip -- long path buffer overflow
ImageMagick -- EXIF parser buffer overflow
2004-12-09 squid -- possible information disclosure
2004-12-07 cscope -- symlink attack vulnerability
2004-12-02 rockdodger -- buffer overflows
2004-12-01 sudoscript -- signal delivery vulnerability
2004-11-30 jabberd -- remote buffer overflow vulnerability
2004-11-26 unarj -- long filename buffer overflow
unarj -- directory traversal vulnerability
2004-11-25 ruby -- CGI DoS
2004-11-24 Cyrus IMAPd -- FETCH command out of bounds memory corruption
Cyrus IMAPd -- PARTIAL command out of bounds memory corruption
2004-11-23 twiki -- arbitrary shell command execution
2004-11-22 Cyrus IMAPd -- APPEND command uses undefined programming construct
Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow
2004-11-20 phpMyAdmin -- cross-site scripting vulnerabilities
2004-11-18 Overflow error in fetch
2004-11-15 proxytunnel -- format string vulnerability
2004-11-13 sudo -- privilege escalation with bash scripts
2004-11-12 gnats -- format string vulnerability
squirrelmail -- cross site scripting vulnerability
2004-11-11 ez-ipupdate -- format string vulnerability
hafiye -- lack of terminal escape sequence filtering
apache2 multiple space header denial-of-service vulnerability
2004-11-10 socat -- format string vulnerability
libxml -- remote buffer overflows
2004-11-09 gdk-pixbuf -- image decoding vulnerabilities
2004-11-08 p5-Archive-Zip -- virus detection evasion
2004-11-06 apache mod_include buffer overflow vulnerability
postgresql-contrib -- insecure temporary file creation
2004-11-05 gd -- integer overflow
2004-11-03 wzdftpd -- remote DoS
bogofilter -- RFC 2047 decoder denial-of-service vulnerability
2004-10-27 horde -- cross-site scripting vulnerability in help window
2004-10-25 rssh -- format string vulnerability
gaim -- MSN denial-of-service vulnerabilities
xpdf -- integer overflow vulnerabilities
gaim -- Content-Length header denial-of-service vulnerability
gaim -- multiple buffer overflows
gaim -- heap overflow exploitable by malicious GroupWise server
gaim -- malicious smiley themes
gaim -- buffer overflow in MSN protocol support
gaim remotely exploitable vulnerabilities in MSN component
Several remotely exploitable buffer overflows in gaim
2004-10-23 mod_ssl -- SSLCipherSuite bypass
2004-10-22 cabextract -- insecure directory handling
2004-10-21 apache2 -- SSL remote DoS
Buffer overflow in INN control message handling
2004-10-20 phpmyadmin -- remote command execution vulnerability
2004-10-19 ifmail -- unsafe set-user-ID application
imwheel -- insecure handling of PID file
freeradius -- denial-of-service vulnerability
2004-10-18 squid -- NTLM authentication denial-of-service vulnerability
2004-10-17 cacti -- SQL injection
apache13-modssl -- format string vulnerability in proxy support
2004-10-15 tor -- remote DoS and loss of anonymity
2004-10-14 xerces-c2 -- Attribute blowup denial-of-service
2004-10-13 icecast -- HTTP header overflow
icecast -- Cross-Site Scripting Vulnerability
wordpress -- XSS in administration panel
CUPS -- local information disclosure
sharutils -- buffer overflows
2004-10-12 zinf -- potential buffer overflow playlist support
mail-notification -- denial-of-service vulnerability
cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin
xv -- exploitable buffer overflows
php -- vulnerability in RFC 1867 file upload processing
2004-10-08 cyrus-sasl -- dynamic library loading and set-user-ID applications
2004-10-05 imp3 -- XSS hole in the HTML viewer
bmon -- unsafe set-user-ID application
gnutls -- certificate chain verification DoS
php -- php_variables memory disclosure
apache -- heap overflow in mod_proxy
2004-10-04 getmail -- symlink vulnerability during maildir delivery
Boundary checking errors in syscons
2004-10-03 racoon -- improper certificate handling
distcc -- incorrect parsing of IP access control rules
2004-10-02 php -- memory_limit related vulnerability
2004-09-30 mozilla -- scripting vulnerabilities
mozilla -- users may be lured into bypassing security dialogs
mozilla -- hostname spoofing bug
mozilla -- BMP decoder vulnerabilities
mozilla -- vCard stack buffer overflow
2004-09-28 mozilla -- multiple heap buffer overflows
Several vulnerabilities found in PHPNuke
Remote code injection in phpMyAdmin
2004-09-26 subversion -- WebDAV fails to protect metadata
mozilla -- automated file upload
2004-09-24 mozilla -- NULL bytes in FTP URLs
2004-09-23 lha -- numerous vulnerabilities when extracting archives
mysql -- heap buffer overflow with prepared statements
2004-09-22 mozilla -- security icon spoofing
mozilla -- built-in CA certificates may be overridden
mozilla -- SOAPParameter integer overflow
2004-09-21 rssh -- file name disclosure bug
2004-09-20 sudo -- sudoedit information disclosure
2004-09-19 cvs -- numerous vulnerabilities
2004-09-15 cups -- print queue browser denial-of-service
apache -- apr_uri_parse IPv6 address handling vulnerability
apache -- ap_resolve_env buffer overflow
mod_dav -- lock related denial-of-service
webmin -- insecure temporary file creation at installation time
2004-09-14 mozilla -- POP client heap overflow
openoffice -- document disclosure
mpg123 buffer overflow
ImageMagick -- BMP decoder buffer overflow
Mutiple browser frame injection vulnerability
isakmpd payload handling denial-of-service vulnerabilities
2004-09-02 imlib -- BMP decoder heap buffer overflow
2004-08-31 krb5 -- ASN.1 decoder denial-of-service vulnerability
krb5 -- double-free vulnerabilities
imlib2 -- BMP decoder buffer overflow
2004-08-28 SpamAssassin -- denial-of-service in tokenize_headers
tnftpd -- remotely exploitable vulnerability
Ruby insecure file permissions in the CGI session management
MySQL authentication bypass / buffer overflow
2004-08-27 ripMIME -- decoding bug allowing content filter bypass
nss -- exploitable buffer overflow in SSLv2 protocol handler
2004-08-26 rsync -- path sanitizing vulnerability
moinmoin -- ACL group bypass
gnomevfs -- unsafe URI handling
SoX buffer overflows when handling .WAV files
kdelibs -- konqueror cross-domain cookie injection
2004-08-23 fidogate -- write files as `news' user
Arbitrary code execution via a format string vulnerability in jftpgw
2004-08-22 qt -- image loader vulnerabilities
mysql -- mysqlhotcopy insecure temporary file creation
2004-08-15 libpng stack-based buffer overflow and other code concerns
Mozilla / Firefox user interface spoofing vulnerability
2004-08-12 kdelibs insecure temporary file handling
popfile file disclosure
ImageMagick png vulnerability fix
Mozilla certificate spoofing
isc-dhcp3-server buffer overflow in logging mechanism
libpng denial-of-service
2004-07-16 Courier mail services: remotely exploitable buffer overflows
2004-07-11 multiple vulnerabilities in ethereal
multiple vulnerabilities in ethereal
multiple vulnerabilities in ethereal
2004-07-05 Format string vulnerability in SSLtelnet
"Content-Type" XSS vulnerability affecting other webmail systems
2004-07-03 Pavuk HTTP Location header overflow
2004-07-02 GNATS local privilege elevation
2004-06-30 Linux binary compatibility mode input validation error
2004-06-29 Remote Denial of Service of HTTP server and client
2004-06-28 XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0
MoinMoin administrative group name privilege escalation vulnerability
2004-06-27 Cyrus IMAP pre-authentication heap overflow vulnerability
mplayer heap overflow in http requests
ecartis buffer overflows and input validation bugs
ModSecurity for Apache 2.x remote off-by-one overflow
clamav remote denial-of-service
2004-06-25 neon date parsing vulnerability
neon format string vulnerabilities
2004-06-24 Gallery 1.4.3 and ealier user authentication bypass
2004-06-14 Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling
2004-06-09 Buffer overflow in Squid NTLM authentication helper
2004-06-08 Vulnerabilities in H.323 implementations
2004-06-07 jailed processes can manipulate host routing tables
2004-05-26 buffer cache invalidation implementation issues
2004-05-21 MySQL insecure temporary file creation (mysqlbug)
2004-05-19 subversion date parsing vulnerability
cvs pserver remote heap buffer overflow
Apache 2 mod_ssl denial-of-service
2004-05-18 URI handler vulnerabilities in several browsers
2004-05-17 fsp buffer overflow and directory traversal vulnerabilities
2004-05-15 proftpd IP address access control list breakage
2004-05-09 insecure temporary file creation in xine-check, xine-bugreport
2004-05-06 phpBB session table exhaustion
exim buffer overflow when verify = header_syntax is used
2004-05-05 heimdal kadmind remote heap buffer overflow
CVS path validation errors
mksnap_ffs clears file system options
shmat reference counting bug
jailed processes can attach to other jails
many out-of-sequence TCP packets denial-of-service
Incorrect cross-realm trust handling in Heimdal
setsockopt(2) IPv6 sockets input validation error
OpenSSL ChangeCipherSpec denial-of-service vulnerability
bind8 negative cache poison attack
2004-05-03 lha buffer overflows and path traversal issues
xchat remotely exploitable buffer overflow (Socks5)
2004-05-02 rsync path traversal issue
xine-lib arbitrary file overwrite
pound remotely exploitable vulnerability
2004-04-23 phpBB IP address spoofing
TCP denial-of-service attacks against long lived connections
ident2 double byte buffer overflow
2004-04-15 kdepim exploitable buffer overflow in VCF reader
2004-04-14 racoon remote denial of service vulnerability (ISAKMP header length field)
racoon remote denial of service vulnerability (IKE Generic Payload Header)
tcpdump ISAKMP payload handling remote denial-of-service
2004-04-13 Midnight Commander buffer overflow during symlink resolution
2004-04-07 racoon fails to verify signature during Phase 1
2004-04-05 oftpd denial-of-service vulnerability (PORT command)
2004-03-30 squid ACL bypass due to URL decoding bug
2004-03-29 zebra/quagga denial of service vulnerability
multiple vulnerabilities in phpBB
ezbounce remote format string vulnerability
racoon security association deletion vulnerability
wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed
GNU Anubis buffer overflows and format string vulnerabilities
multiple buffer overflows in xboing
metamail format string bugs and buffer overflows
Buffer overflows in XFree86 servers
2004-03-28 Buffer overflows and format string bugs in Emil
Critical SQL injection in phpBB
2004-03-25 uudeview buffer overflows
2004-03-12 Apache 1.3 IP address access control failure on some 64-bit platforms
2004-03-11 mod_python denial-of-service vulnerability in parse_qs
2004-03-07 mpg123 vulnerabilities
2004-02-25 mailman denial-of-service vulnerability in MailCommandHandler
mailman XSS in admin script
mailman XSS in create script
mailman XSS in user options page
SQL injection vulnerability in phpnuke
lbreakout2 vulnerability in environment variable handling
hsftp format string vulnerabilities
Darwin Streaming Server denial-of-service vulnerability
libxml2 stack buffer overflow in URI parsing
2004-02-22 file disclosure in phpMyAdmin
2004-02-15 mnGoSearch buffer overflow in UdmDocToTextBuf()
2004-02-13 GNU libtool insecure temporary file handling
2004-02-12 seti@home remotely exploitable buffer overflow
icecast 1.x multiple vulnerabilities
nap allows arbitrary file access
CCE contains exploitable buffer overflows
pine remotely exploitable buffer overflow in newmail.c
ChiTeX/ChiLaTeX unsafe set-user-id root
pine insecure URL handling
pine remote denial-of-service attack
pine remotely exploitable vulnerabilities
rsync buffer overflow in server mode
Samba 3.0.x password initialization bug
Buffer overflow in Mutt 1.4
2004-02-10 Apache-SSL optional client certificate vulnerability
2004-01-19 L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump
2004-01-05 ProFTPD ASCII translation bug resulting in remote root compromise
2003-12-12 ElGamal sign+encrypt keys created by GnuPG can be compromised
Mathopd buffer overflow
lftp HTML parsing vulnerability
qpopper format string vulnerability
2003-10-25 Buffer overflow in pam_smb password handling
Buffer overflows in libmcrypt