{"cves":[{"id":"CVE-2009-4587","published":"2010-01-07T18:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCherokee Web Server 0.5.4 allows remote attackers to cause a denial of\nservice (daemon crash) via an MS-DOS reserved word in a URI, as\ndemonstrated by the AUX reserved word.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"PoC: http://xc0re.wordpress.com/2009/10/25/cherokee-web-server-0-5-4-denial-of-service/\nwindows-specific"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4587"],"bugs":[""],"patches":{"cherokee":[]},"tags":{},"packages":[{"name":"cherokee","source":"https://ubuntu.com/security/cve?package=cherokee","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=cherokee","debian":"https://tracker.debian.org/pkg/cherokee","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4565","published":"2010-01-04T21:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nsendmail before 8.14.4 does not properly handle a '\\0' character in a\nCommon Name (CN) field of an X.509 certificate, which (1) allows\nman-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a\ncrafted server certificate issued by a legitimate Certification Authority,\nand (2) allows remote attackers to bypass intended access restrictions via\na crafted client certificate issued by a legitimate Certification\nAuthority, a related issue to CVE-2009-2408.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"sendmail is in main only for libmilter, all other binary\npackages are in universe. This flaw affects sendmail packages\nin universe."}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.sendmail.org/releases/8.14.4","https://www.cve.org/CVERecord?id=CVE-2009-4565"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564581","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-4565"],"patches":{"sendmail":["vendor: http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:003","vendor: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=21;filename=sendmail_8.14.3-9.1.debdiff;att=1;bug=564581","vendor: https://bugzilla.redhat.com/attachment.cgi?id=382283&action=diff"]},"tags":{"sendmail":["universe-binary"]},"packages":[{"name":"sendmail","source":"https://ubuntu.com/security/cve?package=sendmail","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=sendmail","debian":"https://tracker.debian.org/pkg/sendmail","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"8.14.3-9.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"8.14.3-9.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"8.14.3-9.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"8.14.3-9.1ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"8.14.4","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4502","published":"2009-12-31T18:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when\nrunning on FreeBSD or Solaris, allows remote attackers to bypass the\nEnableRemoteCommands setting and execute arbitrary commands via shell\nmetacharacters in the argument to net.tcp.listen.  NOTE: this attack is\nlimited to attacks from trusted IP addresses.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4502"],"bugs":[""],"patches":{"zabbix":[]},"tags":{},"packages":[{"name":"zabbix","source":"https://ubuntu.com/security/cve?package=zabbix","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=zabbix","debian":"https://tracker.debian.org/pkg/zabbix","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.7","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4501","published":"2009-12-31T18:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server\nbefore 1.6.8 allows remote attackers to cause a denial of service (crash)\nvia a request that lacks expected separators, which triggers a NULL pointer\ndereference, as demonstrated using the Command keyword.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4501"],"bugs":[""],"patches":{"zabbix":[]},"tags":{},"packages":[{"name":"zabbix","source":"https://ubuntu.com/security/cve?package=zabbix","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=zabbix","debian":"https://tracker.debian.org/pkg/zabbix","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4500","published":"2009-12-31T18:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe process_trap function in trapper/trapper.c in Zabbix Server before\n1.6.6 allows remote attackers to cause a denial of service (crash) via a\ncrafted request with data that lacks an expected : (colon) separator, which\ntriggers a NULL pointer dereference.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4500"],"bugs":[""],"patches":{"zabbix":[]},"tags":{},"packages":[{"name":"zabbix","source":"https://ubuntu.com/security/cve?package=zabbix","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=zabbix","debian":"https://tracker.debian.org/pkg/zabbix","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.6","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4499","published":"2009-12-31T18:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nSQL injection vulnerability in the get_history_lastid function in the\nnodewatcher component in Zabbix Server before 1.6.8 allows remote attackers\nto execute arbitrary SQL commands via a crafted request, possibly related\nto the send_history_last_id function in\nzabbix_server/trapper/nodehistory.c.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4499"],"bugs":[""],"patches":{"zabbix":[]},"tags":{},"packages":[{"name":"zabbix","source":"https://ubuntu.com/security/cve?package=zabbix","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=zabbix","debian":"https://tracker.debian.org/pkg/zabbix","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.6.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4498","published":"2009-12-31T18:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe node_process_command function in Zabbix Server before 1.8 allows remote\nattackers to execute arbitrary commands via a crafted request.","ubuntu_description":"","notes":[],"codename":null,"priority":"high","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4498"],"bugs":[""],"patches":{"zabbix":[]},"tags":{},"packages":[{"name":"zabbix","source":"https://ubuntu.com/security/cve?package=zabbix","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=zabbix","debian":"https://tracker.debian.org/pkg/zabbix","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1:1.8-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.8","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-7250","published":"2009-12-30T22:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in Squid Analysis Report Generator\n(Sarg) 2.2.4 allows remote attackers to inject arbitrary web script or HTML\nvia a JavaScript onload event in the User-Agent header, which is not\nproperly handled when displaying the Squid proxy log. NOTE: this issue\nexists because of an incomplete fix for CVE-2008-1168.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-7250"],"bugs":[""],"patches":{"sarg":[]},"tags":{},"packages":[{"name":"sarg","source":"https://ubuntu.com/security/cve?package=sarg","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=sarg","debian":"https://tracker.debian.org/pkg/sarg","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"2.2.5-1ubuntu0.8.04.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.2.5","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-7249","published":"2009-12-30T22:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nBuffer overflow in Squid Analysis Report Generator (Sarg) 2.2.3.1, and\nprobably later, allows user-assisted remote attackers to execute arbitrary\ncode via a long HTTP request method in a crafted access.log file, a\ndifferent vulnerability than CVE-2008-1167.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-7249"],"bugs":[""],"patches":{"sarg":[]},"tags":{},"packages":[{"name":"sarg","source":"https://ubuntu.com/security/cve?package=sarg","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=sarg","debian":"https://tracker.debian.org/pkg/sarg","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"2.2.5-1ubuntu0.8.04.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.2.4","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4481","published":"2009-12-30T21:30:00","updated_at":"2025-08-04T19:23:40.469914+00:00","description":"\nRejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs:\nCVE-2009-3111.  Reason: This candidate is a duplicate of CVE-2009-3111.\nNotes: All CVE users should reference CVE-2009-3111 instead of this\ncandidate.  All references and descriptions in this candidate have been\nremoved to prevent accidental usage","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4481"],"bugs":[""],"patches":{"freeradius":[]},"tags":{},"packages":[{"name":"freeradius","source":"https://ubuntu.com/security/cve?package=freeradius","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=freeradius","debian":"https://tracker.debian.org/pkg/freeradius","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.0.0","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4459","published":"2009-12-30T20:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nRedmine 0.8.7 and earlier uses the title tag before defining the character\nencoding in a meta tag, which allows remote attackers to conduct cross-site\nscripting (XSS) attacks and inject arbitrary script via UTF-7 encoded\nvalues in the title parameter to a new issue page, which may be interpreted\nas script by Internet Explorer 7 and 8.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4459"],"bugs":[""],"patches":{"redmine":[]},"tags":{},"packages":[{"name":"redmine","source":"https://ubuntu.com/security/cve?package=redmine","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=redmine","debian":"https://tracker.debian.org/pkg/redmine","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.9.0","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4484","published":"2009-12-30T00:00:00","updated_at":"2025-05-26T12:47:08.894747+00:00","description":"\nMultiple stack-based buffer overflows in the CertDecoder::GetName function\nin src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in\nMySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through\n5.5.0-m2, and other products, allow remote attackers to execute arbitrary\ncode or cause a denial of service (memory corruption and daemon crash) by\nestablishing an SSL connection and sending an X.509 client certificate with\na crafted name field, as demonstrated by mysql_overflow1.py and the\nvd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was\noriginally reported for MySQL 5.0.51a.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"PoC: http://intevydis.com/mysql_overflow1.py.txt"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html","https://ubuntu.com/security/notices/USN-897-1","https://www.cve.org/CVERecord?id=CVE-2009-4484","https://ubuntu.com/security/notices/USN-1397-1"],"bugs":["http://bugs.mysql.com/bug.php?id=50227"],"patches":{"mysql-dfsg-5.0":["upstream: http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1"],"mysql-dfsg-5.1":["upstream: http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.1/revision/3311.1.3"]},"tags":{"mysql-dfsg-5.0_hardy":["apparmor"],"mysql-dfsg-5.0_intrepid":["apparmor"],"mysql-dfsg-5.0_jaunty":["apparmor"],"mysql-dfsg-5.1_karmic":["apparmor"]},"packages":[{"name":"mysql-5.1","source":"https://ubuntu.com/security/cve?package=mysql-5.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mysql-5.1","debian":"https://tracker.debian.org/pkg/mysql-5.1","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"released","description":"5.1.41-3ubuntu7","component":null,"pocket":"security"},{"release_codename":"natty","status":"released","description":"5.1.41-3ubuntu7","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"mysql-dfsg-5.0","source":"https://ubuntu.com/security/cve?package=mysql-dfsg-5.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mysql-dfsg-5.0","debian":"https://tracker.debian.org/pkg/mysql-dfsg-5.0","statuses":[{"release_codename":"dapper","status":"released","description":"5.0.22-0ubuntu6.06.12","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"5.0.51a-3ubuntu5.5","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"5.0.67-0ubuntu6.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"5.1.30really5.0.75-0ubuntu10.3","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"mysql-dfsg-5.1","source":"https://ubuntu.com/security/cve?package=mysql-dfsg-5.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mysql-dfsg-5.1","debian":"https://tracker.debian.org/pkg/mysql-dfsg-5.1","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"5.1.37-1ubuntu5.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"5.1.41-3ubuntu7","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-897-1","USN-1397-1"],"notices":[{"id":"USN-897-1","title":"MySQL vulnerabilities","summary":"MySQL vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2010-02-10T14:56:22.337606","description":"It was discovered that MySQL could be made to overwrite existing table\nfiles in the data directory. An authenticated user could use the DATA\nDIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks.\nThis update alters table creation behaviour by disallowing the use of the\nMySQL data directory in DATA DIRECTORY and INDEX DIRECTORY options. This\nissue only affected Ubuntu 8.10. (CVE-2008-4098) \n\nIt was discovered that MySQL contained a cross-site scripting vulnerability\nin the command-line client when the --html option is enabled. An attacker\ncould place arbitrary web script or html in a database cell, which would\nthen get placed in the html document output by the command-line tool. This\nissue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04.\n(CVE-2008-4456)\n\nIt was discovered that MySQL could be made to overwrite existing table\nfiles in the data directory. An authenticated user could use symlinks\ncombined with the DATA DIRECTORY and INDEX DIRECTORY options to possibly\nbypass privilege checks. This issue only affected Ubuntu 9.10.\n(CVE-2008-7247)\n\nIt was discovered that MySQL contained multiple format string flaws when\nlogging database creation and deletion. An authenticated user could use\nspecially crafted database names to make MySQL crash, causing a denial of\nservice. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04.\n(CVE-2009-2446)\n\nIt was discovered that MySQL incorrectly handled errors when performing\ncertain SELECT statements, and did not preserve correct flags when\nperforming statements that use the GeomFromWKB function. An authenticated\nuser could exploit this to make MySQL crash, causing a denial of service.\n(CVE-2009-4019)\n\nIt was discovered that MySQL incorrectly checked symlinks when using the\nDATA DIRECTORY and INDEX DIRECTORY options. A local user could use symlinks\nto create tables that pointed to tables known to be created at a later\ntime, bypassing access restrictions. (CVE-2009-4030)\n\nIt was discovered that MySQL contained a buffer overflow when parsing\nssl certificates. A remote attacker could send crafted requests and cause a\ndenial of service or possibly execute arbitrary code. This issue did not\naffect Ubuntu 6.06 LTS and the default compiler options for affected\nreleases should reduce the vulnerability to a denial of service. In the\ndefault installation, attackers would also be isolated by the AppArmor\nMySQL profile. (CVE-2009-4484)\n","is_hidden":false,"release_packages":{"hardy":[{"name":"mysql-dfsg-5.0","version":"5.0.51a-3ubuntu5.5","description":"","is_source":true},{"name":"mysql-server-5.0","version":"5.0.51a-3ubuntu5.5","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0","version_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0/5.0.51a-3ubuntu5.5"}],"dapper":[{"name":"mysql-dfsg-5.0","version":"5.0.22-0ubuntu6.06.12","description":"","is_source":true},{"name":"mysql-server-5.0","version":"5.0.22-0ubuntu6.06.12","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0","version_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0/5.0.22-0ubuntu6.06.12"}],"intrepid":[{"name":"mysql-dfsg-5.0","version":"5.0.67-0ubuntu6.1","description":"","is_source":true},{"name":"mysql-server-5.0","version":"5.0.67-0ubuntu6.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0","version_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0/5.0.67-0ubuntu6.1"}],"jaunty":[{"name":"mysql-dfsg-5.0","version":"5.1.30really5.0.75-0ubuntu10.3","description":"","is_source":true},{"name":"mysql-server-5.0","version":"5.1.30really5.0.75-0ubuntu10.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0","version_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0/5.1.30really5.0.75-0ubuntu10.3"}],"karmic":[{"name":"mysql-dfsg-5.1","version":"5.1.37-1ubuntu5.1","description":"","is_source":true},{"name":"mysql-server-5.1","version":"5.1.37-1ubuntu5.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.1","version_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.1/5.1.37-1ubuntu5.1"}]},"type":"USN","cves_ids":["CVE-2008-7247","CVE-2009-4019","CVE-2009-4030","CVE-2009-4484","CVE-2008-4456","CVE-2008-4098","CVE-2009-2446"]},{"id":"USN-1397-1","title":"MySQL vulnerabilities","summary":"Several security issues were fixed in MySQL.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2012-03-12T14:37:53.714964","description":"Multiple security issues were discovered in MySQL and this update includes\nnew upstream MySQL versions to fix these issues.\n\nMySQL has been updated to 5.1.61 in Ubuntu 10.04 LTS, Ubuntu 10.10,\nUbuntu 11.04 and Ubuntu 11.10. Ubuntu 8.04 LTS has been updated to\nMySQL 5.0.95.\n\nIn addition to security fixes, the updated packages contain bug fixes, new\nfeatures, and possibly incompatible changes.\n\nPlease see the following for more information:\n\nhttp://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html\nhttp://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html\nhttp://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html\n","is_hidden":false,"release_packages":{"hardy":[{"name":"mysql-dfsg-5.0","version":"5.0.95-0ubuntu1","description":"MySQL database","is_source":true},{"name":"mysql-server-5.0","version":"5.0.95-0ubuntu1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0","version_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.0/5.0.95-0ubuntu1"}],"lucid":[{"name":"mysql-dfsg-5.1","version":"5.1.61-0ubuntu0.10.04.1","description":"MySQL database","is_source":true},{"name":"mysql-server-5.1","version":"5.1.61-0ubuntu0.10.04.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.1","version_link":"https://launchpad.net/ubuntu/+source/mysql-dfsg-5.1/5.1.61-0ubuntu0.10.04.1"}],"maverick":[{"name":"mysql-5.1","version":"5.1.61-0ubuntu0.10.10.1","description":"MySQL database","is_source":true},{"name":"mysql-server-5.1","version":"5.1.61-0ubuntu0.10.10.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-5.1","version_link":"https://launchpad.net/ubuntu/+source/mysql-5.1/5.1.61-0ubuntu0.10.10.1"}],"natty":[{"name":"mysql-5.1","version":"5.1.61-0ubuntu0.11.04.1","description":"MySQL database","is_source":true},{"name":"mysql-server-5.1","version":"5.1.61-0ubuntu0.11.04.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-5.1","version_link":"https://launchpad.net/ubuntu/+source/mysql-5.1/5.1.61-0ubuntu0.11.04.1"}],"oneiric":[{"name":"mysql-5.1","version":"5.1.61-0ubuntu0.11.10.1","description":"MySQL database","is_source":true},{"name":"mysql-server-5.1","version":"5.1.61-0ubuntu0.11.10.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/mysql-5.1","version_link":"https://launchpad.net/ubuntu/+source/mysql-5.1/5.1.61-0ubuntu0.11.10.1"}]},"type":"USN","cves_ids":["CVE-2007-5925","CVE-2008-3963","CVE-2008-4098","CVE-2008-4456","CVE-2008-7247","CVE-2009-2446","CVE-2009-4019","CVE-2009-4030","CVE-2009-4484","CVE-2010-1621","CVE-2010-1626","CVE-2010-1848","CVE-2010-1849","CVE-2010-1850","CVE-2010-2008","CVE-2010-3677","CVE-2010-3678","CVE-2010-3679","CVE-2010-3680","CVE-2010-3681","CVE-2010-3682","CVE-2010-3683","CVE-2010-3833","CVE-2010-3834","CVE-2010-3835","CVE-2010-3836","CVE-2010-3837","CVE-2010-3838","CVE-2010-3839","CVE-2010-3840","CVE-2011-2262","CVE-2012-0075","CVE-2012-0087","CVE-2012-0101","CVE-2012-0102","CVE-2012-0112","CVE-2012-0113","CVE-2012-0114","CVE-2012-0115","CVE-2012-0116","CVE-2012-0117","CVE-2012-0118","CVE-2012-0119","CVE-2012-0120","CVE-2012-0484","CVE-2012-0485","CVE-2012-0486","CVE-2012-0487","CVE-2012-0488","CVE-2012-0489","CVE-2012-0490","CVE-2012-0491","CVE-2012-0492","CVE-2012-0493","CVE-2012-0494","CVE-2012-0495","CVE-2012-0496"]}]},{"id":"CVE-2009-3295","published":"2009-12-29T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm\nreferral implementation in the Key Distribution Center (KDC) in MIT\nKerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a\ndenial of service (NULL pointer dereference and daemon crash) via a ticket\nrequest.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-879-1","https://www.cve.org/CVERecord?id=CVE-2009-3295"],"bugs":[""],"patches":{"krb5":[]},"tags":{},"packages":[{"name":"krb5","source":"https://ubuntu.com/security/cve?package=krb5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=krb5","debian":"https://tracker.debian.org/pkg/krb5","statuses":[{"release_codename":"dapper","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"1.7dfsg~beta3-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.7.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-879-1"],"notices":[{"id":"USN-879-1","title":"Kerberos vulnerability","summary":"Kerberos vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2010-01-06T04:57:30.529094","description":"Jeff Blaine, Radoslav Bodo, Jakob Haufe, and Jorgen Wahlsten discovered\nthat the Kerberos Key Distribution Center service did not correctly verify\ncertain network traffic.  An unauthenticated remote attacker could send\na specially crafted request that would cause the KDC to crash, leading\nto a denial of service.\n","is_hidden":false,"release_packages":{"karmic":[{"name":"krb5","version":"1.7dfsg~beta3-1ubuntu0.1","description":"","is_source":true},{"name":"krb5-kdc","version":"1.7dfsg~beta3-1ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/krb5","version_link":"https://launchpad.net/ubuntu/+source/krb5/1.7dfsg~beta3-1ubuntu0.1"}]},"type":"USN","cves_ids":["CVE-2009-3295"]}]},{"id":"CVE-2009-4007","published":"2009-12-28T19:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nUnspecified vulnerability in the NormaliseTrainConsist function in\nsrc/train_cmd.cpp in OpenTTD before 0.7.5-RC1 allows remote attackers to\ncause a denial of service (daemon crash) via certain game actions involving\na wagon and a dual-headed engine.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4007"],"bugs":[""],"patches":{"openttd":["debdiff: https://bugs.launchpad.net/ubuntu/+source/openttd/+bug/503725"]},"tags":{},"packages":[{"name":"openttd","source":"https://ubuntu.com/security/cve?package=openttd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openttd","debian":"https://tracker.debian.org/pkg/openttd","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"0.7.5-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"0.7.5-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"0.7.5-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"0.7.5-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.7.5","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4427","published":"2009-12-28T19:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nDirectory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows\nremote attackers to include and execute arbitrary local files via a .. (dot\ndot) in the cmd parameter.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"according to upstream, this affects 1.1.0.7 and lower"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page","https://www.cve.org/CVERecord?id=CVE-2009-4427"],"bugs":["https://bugs.edge.launchpad.net/ubuntu/+source/phpldapadmin/+bug/511189"],"patches":{"phpldapadmin":["vendor: http://www.debian.org/security/2010/dsa-1965","debdiff: https://bugs.launchpad.net/ubuntu/jaunty/+source/phpldapadmin/+bug/511189"]},"tags":{},"packages":[{"name":"phpldapadmin","source":"https://ubuntu.com/security/cve?package=phpldapadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpldapadmin","debian":"https://tracker.debian.org/pkg/phpldapadmin","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1.1.0.5-6ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.1.0.7-1.2ubuntu2","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1.2.0.5-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.2.0.5-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.2.0.5-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.1.0.7-1.2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4422","published":"2009-12-24T17:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in the GetURLArguments\nfunction in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow remote\nattackers to inject arbitrary web script or HTML via a key to\ncsim_in_html_ex1.php, and other unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4422"],"bugs":[""],"patches":{"libphp-jpgraph":[]},"tags":{},"packages":[{"name":"libphp-jpgraph","source":"https://ubuntu.com/security/cve?package=libphp-jpgraph","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libphp-jpgraph","debian":"https://tracker.debian.org/pkg/libphp-jpgraph","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.5.2-12","component":null,"pocket":"security"},{"release_codename":"maverick","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"natty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"1.5.2-12","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"1.5.2-12","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"1.5.2-12.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4418","published":"2009-12-24T17:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe unserialize function in PHP 5.3.0 and earlier allows context-dependent\nattackers to cause a denial of service (resource consumption) via a deeply\nnested serialized variable, as demonstrated by a string beginning with a:1:\nfollowed by many {a:1: sequences.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"as of 2010/01/04, not fixed yet\ncan only be exploited by a malicious script, not a security\nissue. Marking as ignored."}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.suspekt.org/2009/11/28/shocking-news-in-php-exploitation/","https://www.cve.org/CVERecord?id=CVE-2009-4418"],"bugs":[""],"patches":{"php5":[]},"tags":{},"packages":[{"name":"php5","source":"https://ubuntu.com/security/cve?package=php5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=php5","debian":"https://tracker.debian.org/pkg/php5","statuses":[{"release_codename":"dapper","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"ignored","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4416","published":"2009-12-24T16:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in login.php in phpGroupWare\n0.9.16.12, and possibly other versions before 0.9.16.014, allows remote\nattackers to inject arbitrary web script or HTML via an arbitrary parameter\nwhose name begins with the \"phpgw_\" sequence.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4416"],"bugs":[""],"patches":{"phpgroupware":[]},"tags":{},"packages":[{"name":"phpgroupware","source":"https://ubuntu.com/security/cve?package=phpgroupware","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpgroupware","debian":"https://tracker.debian.org/pkg/phpgroupware","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1:0.9.16.012+dfsg-8+lenny1build0.9.04.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"1:0.9.16.012+dfsg-8+lenny1build0.9.10.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1:0.9.16.012+dfsg-10","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:0.9.16.012+dfsg-9","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4415","published":"2009-12-24T16:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and\npossibly other versions before 0.9.16.014, allow remote attackers to (1)\nread arbitrary files via the csvfile parameter to\naddressbook/csv_import.php, or (2) include and execute arbitrary local\nfiles via the conv_type parameter in addressbook/inc/class.uiXport.inc.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4415"],"bugs":[""],"patches":{"phpgroupware":[]},"tags":{},"packages":[{"name":"phpgroupware","source":"https://ubuntu.com/security/cve?package=phpgroupware","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpgroupware","debian":"https://tracker.debian.org/pkg/phpgroupware","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1:0.9.16.012+dfsg-8+lenny1build0.9.04.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"1:0.9.16.012+dfsg-8+lenny1build0.9.10.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1:0.9.16.012+dfsg-10","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:0.9.16.012+dfsg-9","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2009-4414","published":"2009-12-24T16:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nSQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in\nphpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when\nmagic_quotes_gpc is disabled, allows remote attackers to execute arbitrary\nSQL commands via the passwd parameter to login.php.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2009-4414"],"bugs":[""],"patches":{"phpgroupware":[]},"tags":{},"packages":[{"name":"phpgroupware","source":"https://ubuntu.com/security/cve?package=phpgroupware","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpgroupware","debian":"https://tracker.debian.org/pkg/phpgroupware","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1:0.9.16.012+dfsg-8+lenny1build0.9.04.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"1:0.9.16.012+dfsg-8+lenny1build0.9.10.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1:0.9.16.012+dfsg-10","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1:0.9.16.012+dfsg-9","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":73340,"limit":20,"total_results":79316}