{"cves":[{"id":"CVE-2007-2264","published":"2007-10-31T17:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nHeap-based buffer overflow in RealNetworks RealPlayer 8, 10, 10.1, and\npossibly 10.5; RealOne Player 1 and 2; and RealPlayer Enterprise allows\nremote attackers to execute arbitrary code via a RAM (.ra or .ram) file\nwith a large size value in the RA header.","ubuntu_description":"","notes":[{"author":"kees","note":"http://service.real.com/realplayer/security/10252007_player/en/ \"Issue 5\""}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-2264"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"helix-player","source":"https://ubuntu.com/security/cve?package=helix-player","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=helix-player","debian":"https://tracker.debian.org/pkg/helix-player","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"realplayer","source":"https://ubuntu.com/security/cve?package=realplayer","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=realplayer","debian":"https://tracker.debian.org/pkg/realplayer","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"10.0.9","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-2263","published":"2007-10-31T17:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nHeap-based buffer overflow in RealNetworks RealPlayer 10.0, 10.1, and\npossibly 10.5, RealOne Player, and RealPlayer Enterprise allows remote\nattackers to execute arbitrary code via an SWF (Flash) file with malformed\nrecord headers.","ubuntu_description":"","notes":[{"author":"kees","note":"http://service.real.com/realplayer/security/10252007_player/en/ \"Issue 4\""}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-2263"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"helix-player","source":"https://ubuntu.com/security/cve?package=helix-player","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=helix-player","debian":"https://tracker.debian.org/pkg/helix-player","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"realplayer","source":"https://ubuntu.com/security/cve?package=realplayer","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=realplayer","debian":"https://tracker.debian.org/pkg/realplayer","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"10.0.9","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5740","published":"2007-10-31T16:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe format string protection mechanism in IMAPD for Perdition Mail\nRetrieval Proxy 1.17 and earlier allows remote attackers to execute\narbitrary code via an IMAP tag with a null byte followed by a format string\nspecifier, which is not counted by the mechanism.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5740"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/perdition/+bug/162543"],"patches":{},"tags":{},"packages":[{"name":"perdition","source":"https://ubuntu.com/security/cve?package=perdition","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=perdition","debian":"https://tracker.debian.org/pkg/perdition","statuses":[{"release_codename":"dapper","status":"released","description":"1.17-5ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.17-7ubuntu0.6.10.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.17-7ubuntu0.7.04.1","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"1.17-7ubuntu0.7.10.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.17.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5731","published":"2007-10-30T23:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nAbsolute path traversal vulnerability in Apache Jakarta Slide 2.1 and\nearlier allows remote authenticated users to read arbitrary files via a\nWebDAV write request that specifies an entity with a SYSTEM tag, a related\nissue to CVE-2007-5461.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"only the server is affected, we only have the client"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5731"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"slide-webdavclient","source":"https://ubuntu.com/security/cve?package=slide-webdavclient","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=slide-webdavclient","debian":"https://tracker.debian.org/pkg/slide-webdavclient","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5730","published":"2007-10-30T22:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nHeap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other\nproducts, allows local users to execute arbitrary code via crafted data in\nthe \"net socket listen\" option, aka QEMU \"net socket\" heap overflow.  NOTE:\nsome sources have used CVE-2007-1321 to refer to this issue as part of\n\"NE2000 network driver and the socket code,\" but this is the correct\nidentifier for the individual net socket listen vulnerability.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"kvm includes qemu (0.9.1 on hardy)\nDebian used CVE-2007-1321 for this"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5730"],"bugs":[""],"patches":{"qemu":["vendor: http://www.debian.org/security/2007/dsa-1284"],"qemu-kvm":[]},"tags":{},"packages":[{"name":"kvm","source":"https://ubuntu.com/security/cve?package=kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kvm","debian":"https://tracker.debian.org/pkg/kvm","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"qemu","source":"https://ubuntu.com/security/cve?package=qemu","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu","debian":"https://tracker.debian.org/pkg/qemu","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"qemu-kvm","source":"https://ubuntu.com/security/cve?package=qemu-kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu-kvm","debian":"https://tracker.debian.org/pkg/qemu-kvm","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5729","published":"2007-10-30T22:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary\ncode by writing Ethernet frames with a size larger than the MTU to the\nEN0_TCNT register, which triggers a heap-based buffer overflow in the slirp\nlibrary, aka NE2000 \"mtu\" heap overflow.  NOTE: some sources have used\nCVE-2007-1321 to refer to this issue as part of \"NE2000 network driver and\nthe socket code,\" but this is the correct identifier for the mtu overflow\nvulnerability.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"kvm includes qemu (0.9.1 on hardy)\nkvm does not use ne2000 by default\nDebian used CVE-2007-1321 for this issue"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5729"],"bugs":[""],"patches":{"qemu":["vendor: http://www.debian.org/security/2007/dsa-1284"],"qemu-kvm":[]},"tags":{},"packages":[{"name":"kvm","source":"https://ubuntu.com/security/cve?package=kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kvm","debian":"https://tracker.debian.org/pkg/kvm","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"qemu","source":"https://ubuntu.com/security/cve?package=qemu","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu","debian":"https://tracker.debian.org/pkg/qemu","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"qemu-kvm","source":"https://ubuntu.com/security/cve?package=qemu-kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu-kvm","debian":"https://tracker.debian.org/pkg/qemu-kvm","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"0.9.0-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-1321","published":"2007-10-30T22:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nInteger signedness error in the NE2000 emulator in QEMU 0.8.2, as used in\nXen and possibly other products, allows local users to trigger a heap-based\nbuffer overflow via certain register values that bypass sanity checks, aka\nQEMU NE2000 \"receive\" integer signedness error. NOTE: this identifier was\ninadvertently used by some sources to cover multiple issues that were\nlabeled \"NE2000 network driver and the socket code,\" but separate\nidentifiers have been created for the individual vulnerabilities since\nthere are sometimes different fixes; see CVE-2007-5729 and CVE-2007-5730.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"kvm contains qemu (0.9.1 on hardy)\nkvm does not use ne2000 by default"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-1321"],"bugs":[""],"patches":{"qemu":["vendor: http://www.debian.org/security/2007/dsa-1284"],"kvm":[],"qemu-kvm":[]},"tags":{},"packages":[{"name":"kvm","source":"https://ubuntu.com/security/cve?package=kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kvm","debian":"https://tracker.debian.org/pkg/kvm","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1:62+dfsg-0ubuntu3","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"qemu","source":"https://ubuntu.com/security/cve?package=qemu","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu","debian":"https://tracker.debian.org/pkg/qemu","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"0.9.0-2ubuntu2","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"0.9.0-2ubuntu2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"0.9.0-2ubuntu2","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"0.9.0-2ubuntu2","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"}]},{"name":"qemu-kvm","source":"https://ubuntu.com/security/cve?package=qemu-kvm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=qemu-kvm","debian":"https://tracker.debian.org/pkg/qemu-kvm","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"0.9.0-2ubuntu2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"3.1.0-0ubuntu18","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5728","published":"2007-10-30T21:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and\npossibly 4.1.2, allows remote attackers to inject arbitrary web script or\nHTML via certain input available in PHP_SELF in (1) redirect.php, possibly\nrelated to (2) login.php, different vectors than CVE-2007-2865.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5728"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"phppgadmin","source":"https://ubuntu.com/security/cve?package=phppgadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phppgadmin","debian":"https://tracker.debian.org/pkg/phppgadmin","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"4.1.3-0.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"4.1.3-0.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"4.1.3-0.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"4.1.3-0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4.1.3","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5723","published":"2007-10-30T21:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nHeap-based buffer overflow in the samp_send function in nuauth/sasl.c in\nNuFW before 2.2.7 allows remote attackers to cause a denial of service via\nunspecified input on which base64 encoding is performed. NOTE: some of\nthese details are obtained from third party information.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5723"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"nufw","source":"https://ubuntu.com/security/cve?package=nufw","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=nufw","debian":"https://tracker.debian.org/pkg/nufw","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"2.2.10-2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"2.2.10-2","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"2.2.10-2","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"2.2.10-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.2.7","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5718","published":"2007-10-30T21:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nvobcopy 0.5.14 allows local users to append data to an arbitrary file, or\ncreate an arbitrary new file, via a symlink attack on the (1)\n/tmp/vobcopy.bla or (2) /tmp/vobcopy_0.5.14.log temporary file.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5718"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"vobcopy","source":"https://ubuntu.com/security/cve?package=vobcopy","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vobcopy","debian":"https://tracker.debian.org/pkg/vobcopy","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1.0.2-1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1.0.2-1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1.0.2-1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"1.0.2-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5715","published":"2007-10-30T19:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nDenyHosts 2.6 processes OpenSSH sshd \"not listed in AllowUsers\" log\nmessages with an incorrect regular expression that does not match an IP\naddress, which might allow remote attackers to avoid detection and blocking\nwhen making invalid login attempts with a username not present in\nAllowUsers, as demonstrated by the root username, a different vulnerability\nthan CVE-2007-4323.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5715"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/denyhosts/+bug/133569"],"patches":{},"tags":{},"packages":[{"name":"denyhosts","source":"https://ubuntu.com/security/cve?package=denyhosts","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=denyhosts","debian":"https://tracker.debian.org/pkg/denyhosts","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"2.5-3ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"2.6-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5712","published":"2007-10-30T19:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and\n0.96, and as used in other products such as PyLucid, when the USE_I18N\noption and the i18n component are enabled, allows remote attackers to cause\na denial of service (memory consumption) via many HTTP requests with large\nAccept-Language headers.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5712"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/python-django/+bug/157903"],"patches":{},"tags":{},"packages":[{"name":"python-django","source":"https://ubuntu.com/security/cve?package=python-django","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-django","debian":"https://tracker.debian.org/pkg/python-django","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"0.95.1-1ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"0.96-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.9.6.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5710","published":"2007-10-30T19:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in\nWordPress 2.3 allows remote attackers to inject arbitrary web script or\nHTML via the posts_columns array parameter.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5710"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"wordpress","source":"https://ubuntu.com/security/cve?package=wordpress","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=wordpress","debian":"https://tracker.debian.org/pkg/wordpress","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.3.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5708","published":"2007-10-30T19:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nslapo-pcache (overlays/pcache.c) in slapd in OpenLDAP before 2.3.39, when\nrunning as a proxy-caching server, allocates memory using a malloc variant\ninstead of calloc, which prevents an array from being initialized properly\nand might allow attackers to cause a denial of service (segmentation fault)\nvia unknown vectors that prevent the array from being null terminated.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"initial inspection show this to be a reliability fix\nopenldap2 source package does not ship slapd"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-551-1","https://www.cve.org/CVERecord?id=CVE-2007-5708"],"bugs":["https://launchpad.net/bugs/162162"],"patches":{"openldap2":[]},"tags":{},"packages":[{"name":"openldap2","source":"https://ubuntu.com/security/cve?package=openldap2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2","debian":"https://tracker.debian.org/pkg/openldap2","statuses":[{"release_codename":"dapper","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"openldap2.2","source":"https://ubuntu.com/security/cve?package=openldap2.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2.2","debian":"https://tracker.debian.org/pkg/openldap2.2","statuses":[{"release_codename":"dapper","status":"released","description":"2.2.26-5ubuntu2.4","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"2.2.26-5ubuntu3.2","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.2.39","component":null,"pocket":"security"}]},{"name":"openldap2.3","source":"https://ubuntu.com/security/cve?package=openldap2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2.3","debian":"https://tracker.debian.org/pkg/openldap2.3","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"2.3.30-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.3.35-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.3.39","component":null,"pocket":"security"}]}],"notices_ids":["USN-551-1"],"notices":[{"id":"USN-551-1","title":"OpenLDAP vulnerabilities","summary":"OpenLDAP vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2007-12-04T01:17:43.312347","description":"Thomas Sesselmann discovered that the OpenLDAP slapd server\ndid not properly handle certain modify requests. A remote\nattacker could send malicious modify requests to the server\nand cause a denial of service. (CVE-2007-5707)\n\nToby Blake discovered that slapd did not properly terminate\nan array while running as a proxy-caching server. A remote\nattacker may be able to send crafted search requests to the\nserver and cause a denial of service. This issue only affects\nUbuntu 7.04 and 7.10. (CVE-2007-5708)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"openldap2.3","version":"2.3.35-1ubuntu0.1","description":"","is_source":true},{"name":"slapd","version":"2.3.35-1ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.3","version_link":"https://launchpad.net/ubuntu/+source/openldap2.3/2.3.35-1ubuntu0.1"}],"dapper":[{"name":"openldap2.2","version":"2.2.26-5ubuntu2.4","description":"","is_source":true},{"name":"slapd","version":"2.2.26-5ubuntu2.4","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.2","version_link":"https://launchpad.net/ubuntu/+source/openldap2.2/2.2.26-5ubuntu2.4"}],"feisty":[{"name":"openldap2.3","version":"2.3.30-2ubuntu0.1","description":"","is_source":true},{"name":"slapd","version":"2.3.30-2ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.3","version_link":"https://launchpad.net/ubuntu/+source/openldap2.3/2.3.30-2ubuntu0.1"}],"edgy":[{"name":"openldap2.2","version":"2.2.26-5ubuntu3.2","description":"","is_source":true},{"name":"slapd","version":"2.2.26-5ubuntu3.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.2","version_link":"https://launchpad.net/ubuntu/+source/openldap2.2/2.2.26-5ubuntu3.2"}]},"type":"USN","cves_ids":["CVE-2007-5707","CVE-2007-5708"]}]},{"id":"CVE-2007-5707","published":"2007-10-30T19:46:00","updated_at":"2025-08-04T19:20:54.977947+00:00","description":"\nOpenLDAP before 2.3.39 allows remote attackers to cause a denial of service\n(slapd crash) via an LDAP request with a malformed objectClasses attribute.\n NOTE: this has been reported as a double free, but the reports are\ninconsistent.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"openldap2 source package does not ship slapd"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://access.redhat.com/errata/RHSA-2007:1037","https://ubuntu.com/security/notices/USN-551-1","https://www.cve.org/CVERecord?id=CVE-2007-5707"],"bugs":["https://launchpad.net/bugs/163740","https://launchpad.net/bugs/162162"],"patches":{"openldap2":[]},"tags":{},"packages":[{"name":"openldap2","source":"https://ubuntu.com/security/cve?package=openldap2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2","debian":"https://tracker.debian.org/pkg/openldap2","statuses":[{"release_codename":"dapper","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"openldap2.2","source":"https://ubuntu.com/security/cve?package=openldap2.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2.2","debian":"https://tracker.debian.org/pkg/openldap2.2","statuses":[{"release_codename":"dapper","status":"released","description":"2.2.26-5ubuntu2.4","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"2.2.26-5ubuntu3.2","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.2.39","component":null,"pocket":"security"}]},{"name":"openldap2.3","source":"https://ubuntu.com/security/cve?package=openldap2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2.3","debian":"https://tracker.debian.org/pkg/openldap2.3","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"2.3.30-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.3.35-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.3.39","component":null,"pocket":"security"}]}],"notices_ids":["USN-551-1"],"notices":[{"id":"USN-551-1","title":"OpenLDAP vulnerabilities","summary":"OpenLDAP vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2007-12-04T01:17:43.312347","description":"Thomas Sesselmann discovered that the OpenLDAP slapd server\ndid not properly handle certain modify requests. A remote\nattacker could send malicious modify requests to the server\nand cause a denial of service. (CVE-2007-5707)\n\nToby Blake discovered that slapd did not properly terminate\nan array while running as a proxy-caching server. A remote\nattacker may be able to send crafted search requests to the\nserver and cause a denial of service. This issue only affects\nUbuntu 7.04 and 7.10. (CVE-2007-5708)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"openldap2.3","version":"2.3.35-1ubuntu0.1","description":"","is_source":true},{"name":"slapd","version":"2.3.35-1ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.3","version_link":"https://launchpad.net/ubuntu/+source/openldap2.3/2.3.35-1ubuntu0.1"}],"dapper":[{"name":"openldap2.2","version":"2.2.26-5ubuntu2.4","description":"","is_source":true},{"name":"slapd","version":"2.2.26-5ubuntu2.4","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.2","version_link":"https://launchpad.net/ubuntu/+source/openldap2.2/2.2.26-5ubuntu2.4"}],"feisty":[{"name":"openldap2.3","version":"2.3.30-2ubuntu0.1","description":"","is_source":true},{"name":"slapd","version":"2.3.30-2ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.3","version_link":"https://launchpad.net/ubuntu/+source/openldap2.3/2.3.30-2ubuntu0.1"}],"edgy":[{"name":"openldap2.2","version":"2.2.26-5ubuntu3.2","description":"","is_source":true},{"name":"slapd","version":"2.2.26-5ubuntu3.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/openldap2.2","version_link":"https://launchpad.net/ubuntu/+source/openldap2.2/2.2.26-5ubuntu3.2"}]},"type":"USN","cves_ids":["CVE-2007-5707","CVE-2007-5708"]}]},{"id":"CVE-2007-4999","published":"2007-10-29T22:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nlibpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows\nremote attackers to cause a denial of service (NULL dereference and\napplication crash) via a message that contains invalid HTML data, a\ndifferent vector than CVE-2007-4996.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-548-1","https://www.cve.org/CVERecord?id=CVE-2007-4999"],"bugs":["https://bugs.launchpad.net/bugs/157347","https://bugs.launchpad.net/bugs/158400"],"patches":{},"tags":{},"packages":[{"name":"pidgin","source":"https://ubuntu.com/security/cve?package=pidgin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=pidgin","debian":"https://tracker.debian.org/pkg/pidgin","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"1:2.2.1-1ubuntu4.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.2.2","component":null,"pocket":"security"}]}],"notices_ids":["USN-548-1"],"notices":[{"id":"USN-548-1","title":"Pidgin vulnerability","summary":"Pidgin vulnerability","instructions":"After a standard system upgrade you need to restart Pidgin to effect\nthe necessary changes.\n","references":[],"published":"2007-11-28T21:45:34.951957","description":"It was discovered that Pidgin did not correctly handle certain logging\nevents.  A remote attacker could send specially crafted messages and cause\nthe application to crash, leading to a denial of service.\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"pidgin","version":"1:2.2.1-1ubuntu4.1","description":"","is_source":true},{"name":"libpurple0","version":"1:2.2.1-1ubuntu4.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/pidgin","version_link":"https://launchpad.net/ubuntu/+source/pidgin/1:2.2.1-1ubuntu4.1"}]},"type":"USN","cves_ids":["CVE-2007-4999"]}]},{"id":"CVE-2007-3920","published":"2007-10-29T21:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nGNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not\nproperly reserve input focus, which allows attackers with physical access\nto take control of the session after entering an Alt-Tab sequence, a\nrelated issue to CVE-2007-3069.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-537-1","https://ubuntu.com/security/notices/USN-537-2","https://www.cve.org/CVERecord?id=CVE-2007-3920"],"bugs":["https://launchpad.net/bugs/145123","http://bugzilla.gnome.org/show_bug.cgi?id=488264"],"patches":{},"tags":{},"packages":[{"name":"compiz","source":"https://ubuntu.com/security/cve?package=compiz","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=compiz","debian":"https://tracker.debian.org/pkg/compiz","statuses":[{"release_codename":"gutsy","status":"released","description":"1:0.6.0+git20071008-0ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.6.2+git20071119","component":null,"pocket":"security"}]},{"name":"gnome-screensaver","source":"https://ubuntu.com/security/cve?package=gnome-screensaver","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gnome-screensaver","debian":"https://tracker.debian.org/pkg/gnome-screensaver","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.20.0-0ubuntu4.2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.20.0-0ubuntu5","component":null,"pocket":"security"}]}],"notices_ids":["USN-537-2","USN-537-1"],"notices":[{"id":"USN-537-2","title":"Compiz vulnerability","summary":"Compiz vulnerability","instructions":"After a standard system upgrade you need to restart your session to effect\nthe necessary changes.\n","references":[],"published":"2007-11-02T03:20:22.040516","description":"USN-537-1 fixed vulnerabilities in gnome-screensaver. The fixes were\nincomplete, and only reduced the scope of the vulnerability, without\nfully solving it. This update fixes related problems in compiz.\n\nOriginal advisory details:\n\n Jens Askengren discovered that gnome-screensaver became confused when\n running under Compiz, and could lose keyboard lock focus. A local attacker\n could exploit this to bypass the user's locked screen saver.\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"compiz","version":"1:0.6.0+git20071008-0ubuntu1.1","description":"","is_source":true},{"name":"compiz-core","version":"1:0.6.0+git20071008-0ubuntu1.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/compiz","version_link":"https://launchpad.net/ubuntu/+source/compiz/1:0.6.0+git20071008-0ubuntu1.1"}]},"type":"USN","cves_ids":["CVE-2007-3920"]},{"id":"USN-537-1","title":"gnome-screensaver vulnerability","summary":"gnome-screensaver vulnerability","instructions":"After a standard system upgrade you need to restart your session to effect\nthe necessary changes.\n","references":[],"published":"2007-10-23T19:31:51.756286","description":"Jens Askengren discovered that gnome-screensaver became confused when\nrunning under Compiz, and could lose keyboard lock focus.  A local\nattacker could exploit this to bypass the user's locked screen saver.\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"gnome-screensaver","version":"2.20.0-0ubuntu4.2","description":"","is_source":true},{"name":"gnome-screensaver","version":"2.20.0-0ubuntu4.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/gnome-screensaver","version_link":"https://launchpad.net/ubuntu/+source/gnome-screensaver/2.20.0-0ubuntu4.2"}]},"type":"USN","cves_ids":["CVE-2007-3920"]}]},{"id":"CVE-2007-5695","published":"2007-10-29T20:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nOpen redirect vulnerability in command.php in SiteBar 3.3.8 allows remote\nattackers to redirect users to arbitrary web sites via a URL in the forward\nparameter in a Log In action.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5695"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/sitebar/+bug/175319"],"patches":{},"tags":{},"packages":[{"name":"sitebar","source":"https://ubuntu.com/security/cve?package=sitebar","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=sitebar","debian":"https://tracker.debian.org/pkg/sitebar","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5694","published":"2007-10-29T20:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nAbsolute path traversal vulnerability in the translation module\n(translator.php) in SiteBar 3.3.8 allows remote authenticated users to read\narbitrary files via an absolute path in the dir parameter, a different\nvulnerability than CVE-2007-5491.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5694"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/sitebar/+bug/175319"],"patches":{},"tags":{},"packages":[{"name":"sitebar","source":"https://ubuntu.com/security/cve?package=sitebar","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=sitebar","debian":"https://tracker.debian.org/pkg/sitebar","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2007-5693","published":"2007-10-29T20:46:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nEval injection vulnerability in the translation module (translator.php) in\nSiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP\ncode via the edit parameter in an upd cmd action, a different vulnerability\nthan CVE-2007-5492.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-5693"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/sitebar/+bug/175319"],"patches":{},"tags":{},"packages":[{"name":"sitebar","source":"https://ubuntu.com/security/cve?package=sitebar","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=sitebar","debian":"https://tracker.debian.org/pkg/sitebar","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"3.3.8-12.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":76000,"limit":20,"total_results":79316}