| Description: | Description:
The remote host is missing updates announced in
advisory TSLSA-2007-0024.
file < TSL 3.0.5 > < TSL 3.0 > < TSL 2.2 > < TSEL 2>
- SECURITY Fix: Fixes integer overflow in the file program, that
might allow user-assisted attackers to execute arbitrary code via
a large file that triggers an overflow that bypasses an assert()
statement. This issue is due to an incorrect patch for CVE-2007-1536.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2007-2799 to this issue.
gd < TSL 3.0.5 > < TSL 3.0 > < TSL 2.2 >
- SECURITY Fix: Some vulnerabilities have been reported in the GD
Graphics Library, where some have unknown impact and others can
potentially be exploited to cause a DoS (SA25855).
Includes fixes for CVE-2007-3472 to CVE-2007-3478.
mutt < TSL 3.0.5 > < TSL 3.0 > < TSL 2.2 >
- New Upstream.
- SECURITY Fix: A vulnerability has been reported in mutt, caused
due to a boundary error in the mutt_gecos_name() function when
processing & characters in the GECOS field. This can be exploited
to cause a buffer overflow during alias expansion.
- A weakness has been identified which is caused by an error in the
APOP protocol that fails to properly prevent MD5 collisions. This
could be exploited via man-in-the-middle attacks and specially
crafted message-IDs to potentially disclose the first three
characters of passwords.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2007-2683 and CVE-2007-1558 to these issue.
Solution:
Update your system with the packages as indicated in
the referenced security advisory.
http://www.securityspace.com/smysecure/catid.html?in=TSLSA-2007-0024
Risk factor : Critical
CVSS Score:
9.3
|
