deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-0146
Published: 2005-05-02
Description: Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to obtain sensitive data from the clipboard via Javascript that generates a middle-click event on systems for which a middle-click performs a paste operation.
CVSS Score: 5.0 (MEDIUM)
References: http://www.mozilla.org/security/announce/mfsa2005-08.html; http://www.redhat.com/support/errata/RHSA-2005-335.html; http://www.redhat.com/support/errata/RHSA-2005-384.html
CVE: CVE-2005-0147
Published: 2005-05-02
Description: Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials.
CVSS Score: 7.5 (HIGH)
References: http://www.mozilla.org/security/announce/mfsa2005-09.html; http://www.redhat.com/support/errata/RHSA-2005-323.html; http://www.securityfocus.com/bid/12407
CVE: CVE-2005-0148
Published: 2005-05-02
Description: Thunderbird before 0.9, when running on Windows systems, uses the default handler when processing javascript: links, which invokes Internet Explorer and may expose the Thunderbird user to vulnerabilities in the version of Internet Explorer that is installed on the user's system.  NOTE: since the invocation between multiple products is a common practice, and the vulnerabilities inherent in multi-product interactions are not easily enumerable, this issue might be REJECTED in the future.
CVSS Score: 5.0 (MEDIUM)
References: http://www.mozilla.org/security/announce/mfsa2005-10.html; http://www.securityfocus.com/bid/12407; https://bugzilla.mozilla.org/show_bug.cgi?id=263546
CVE: CVE-2005-0155
Published: 2005-05-02
Description: The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PERLIO_DEBUG variable.
CVSS Score: 4.6 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056; http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2683&w=2
CVE: CVE-2005-0158
Published: 2005-05-02
Description: Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay, or a spoofed eBay server, to cause a denial of service and possibly execute arbitrary code via certain responses.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2005/dsa-687; http://www.gentoo.org/security/en/glsa/glsa-200503-06.xml; http://www.debian.org/security/2005/dsa-687
CVE: CVE-2005-0173
Published: 2005-05-02
Description: squid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a username with a space at the beginning or end, which is ignored by the LDAP server.
CVSS Score: 7.5 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923; http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0947&w=2
CVE: CVE-2005-0183
Published: 2005-05-02
Description: ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line argument.
CVSS Score: 7.2 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0953&w=2; http://secunia.com/advisories/13791; http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-03
CVE: CVE-2005-0184
Published: 2005-05-02
Description: Directory traversal vulnerability in ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to read arbitrary files via a .. (dot dot) in a get request.
CVSS Score: 2.1 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0953&w=2; http://secunia.com/advisories/13791; http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-03
CVE: CVE-2005-0185
Published: 2005-05-02
Description: Stack-based buffer overflow in NodeManager Professional 2.00 allows remote attackers to execute arbitrary commands via a LinkDown-Trap packet that contains a long OCTET-STRING in the Trap variable-bindings field.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8583&w=2; http://secunia.com/advisories/13881/; http://securitytracker.com/id?1012915
CVE: CVE-2005-0187
Published: 2005-05-02
Description: Stack-based buffer overflow in the SetSkin function in AtHoc toolbar allows remote attackers to execute arbitrary code via a long skin name.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4742&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5176&w=2; http://www.ngssoftware.com/advisories/athoc-01full.txt
CVE: CVE-2005-0194
Published: 2005-05-02
Description: Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
CVSS Score: 10.0 (HIGH)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000923; http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0453&w=2
CVE: CVE-2005-0195
Published: 2005-05-02
Description: Cisco IOS 12.0S through 12.3YH allows remote attackers to cause a denial of service (device restart) via a crafted IPv6 packet.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/cisco-sa-20050126-ipv6.shtml; http://www.kb.cert.org/vuls/id/472582; http://www.us-cert.gov/cas/techalerts/TA05-026A.html
CVE: CVE-2005-0196
Published: 2005-05-02
Description: Cisco IOS 12.0 through 12.3YL, with BGP enabled and running the bgp log-neighbor-changes command, allows remote attackers to cause a denial of service (device reload) via a malformed BGP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/14034; http://securitytracker.com/id?1013013; http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml
CVE: CVE-2005-0197
Published: 2005-05-02
Description: Cisco IOS 12.1T, 12.2, 12.2T, 12.3 and 12.3T, with Multi Protocol Label Switching (MPLS) installed but disabled, allows remote attackers to cause a denial of service (device reload) via a crafted packet sent to the disabled interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/14031; http://securitytracker.com/id?1013015; http://www.cisco.com/warp/public/707/cisco-sa-20050126-les.shtml
CVE: CVE-2005-0198
Published: 2005-05-02
Description: A logic error in the CRAM-MD5 code for the University of Washington IMAP (UW-IMAP) server, when Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5) is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticate as arbitrary users.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/14057; http://secunia.com/advisories/14097; http://securitytracker.com/id?1013037
CVE: CVE-2005-0199
Published: 2005-05-02
Description: Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long MODE line that causes an incorrect length calculation, which leads to a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html; http://bugs.gentoo.org/show_bug.cgi?id=79705; http://secunia.com/advisories/14056
CVE: CVE-2005-0200
Published: 2005-05-02
Description: TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/13948; http://tikiwiki.org/art102; http://www.gentoo.org/security/en/glsa/glsa-200501-41.xml
CVE: CVE-2005-0202
Published: 2005-05-02
Description: Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031562.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2386&w=2
CVE: CVE-2005-0204
Published: 2005-05-02
Description: Linux kernel before 2.6.9, when running on the AMD64 and Intel EM64T architectures, allows local users to write to privileged IO ports via the OUTS instruction.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18784; http://www.redhat.com/support/errata/RHSA-2005-092.html; http://www.redhat.com/support/errata/RHSA-2005-293.html
CVE: CVE-2005-0205
Published: 2005-05-02
Description: KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of file descriptors before executing kppp.
CVSS Score: 4.6 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000934; http://www.debian.org/security/2005/dsa-692; http://www.idefense.com/application/poi/display?id=208&type=vulnerabilities
CVE: CVE-2005-0207
Published: 2005-05-02
Description: Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT.
CVSS Score: 2.1 (LOW)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000930; http://www.redhat.com/support/errata/RHSA-2005-366.html; http://www.securityfocus.com/advisories/7880
CVE: CVE-2005-0208
Published: 2005-05-02
Description: The HTML parsing functions in Gaim before 1.1.4 allow remote attackers to cause a denial of service (application crash) via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0473.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000933; http://gaim.sourceforge.net/security/?id=12; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0670&w=2
CVE: CVE-2005-0209
Published: 2005-05-02
Description: Netfilter in Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via crafted IP packet fragments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000945; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6556&w=2; http://www.novell.com/linux/security/advisories/2005_18_kernel.html
CVE: CVE-2005-0210
Published: 2005-05-02
Description: Netfilter in the Linux kernel 2.6.8.1 allows local users to cause a denial of service (memory consumption) via certain packet fragments that are reassembled twice, which causes a data structure to be allocated twice.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000945; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6556&w=2; http://rhn.redhat.com/errata/RHSA-2005-366.html
CVE: CVE-2005-0211
Published: 2005-05-02
Description: Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://fedoranews.org/updates/FEDORA--.shtml; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0947&w=2; http://secunia.com/advisories/14076
CVE: CVE-2005-0212
Published: 2005-05-02
Description: The Amp II engine as used by Gore: Ultimate Soldier 1.50 and earlier allows remote attackers to cause a denial of service (infinite loop) via a zero byte UDP packet.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/amp2zero-adv.txt; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5648&w=2; http://secunia.com/advisories/13754
CVE: CVE-2005-0213
Published: 2005-05-02
Description: Directory traversal vulnerability in WinHKI 1.4d allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a zip file.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3257&w=2; http://secunia.com/advisories/13738; http://securitytracker.com/id?1012798
CVE: CVE-2005-0214
Published: 2005-05-02
Description: Directory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (dot dot) in the entry parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-01/0210.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3989&w=2; http://www.securityfocus.com/bid/12193
CVE: CVE-2005-0215
Published: 2005-05-02
Description: Mozilla 1.6 and possibly other versions allows remote attackers to cause a denial of service (application crash) via a XBM (X BitMap) file with a large (1) height or (2) width value.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9209&w=2; https://exchange.xforce.ibmcloud.com/vulnerabilities/18803; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9209&w=2
CVE: CVE-2005-0216
Published: 2005-05-02
Description: Cross-site scripting (XSS) vulnerability in formmail.php in Woltlab Burning Board Lite 1.0.0, 1.0.1e, and possibly other versions, allows remote attackers to inject arbitrary web script and HTML via the userid parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7004&w=2; http://secunia.com/advisories/13782; http://www.securityfocus.com/bid/12199
CVE: CVE-2005-0217
Published: 2005-05-02
Description: SQL injection vulnerability in index.php in Invision Community Blog allows remote attackers to execute arbitrary SQL commands via the eid parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3800&w=2; http://secunia.com/advisories/13783; http://securitytracker.com/id?1012831
CVE: CVE-2005-0218
Published: 2005-05-02
Description: ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.
CVSS Score: 5.0 (MEDIUM)
References: http://seclists.org/lists/fulldisclosure/2005/Jan/0332.html; http://seclists.org/lists/fulldisclosure/2005/Jan/0537.html; http://secunia.com/advisories/13900/
CVE: CVE-2005-0219
Published: 2005-05-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gallery 1.3.4-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the index field in add_comment.php, (2) set_albumName, (3) slide_index, (4) slide_full, (5) slide_loop, (6) slide_pause, (7) slide_dir fields in slideshow_low.php, or (8) username field in search.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0031.html; http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2364&w=2
CVE: CVE-2005-0220
Published: 2005-05-02
Description: Cross-site scripting vulnerability in login.php in Gallery 1.4.4-pl2 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0031.html; http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2364&w=2
CVE: CVE-2005-0222
Published: 2005-05-02
Description: main.php in Gallery 2.0 Alpha allows remote attackers to gain sensitive information by changing the value of g2_subView parameter, which reveals the path in an error message.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2005-q1/0031.html; http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2364&w=2
CVE: CVE-2005-0223
Published: 2005-05-02
Description: The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.
CVSS Score: 5.0 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9320&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]9320&w=2
CVE: CVE-2005-0225
Published: 2005-05-02
Description: firehol.sh in FireHOL before 1.224 creates temporary files with predictable file names, which could allow local users to overwrite arbitrary files via a symlink attack.
CVSS Score: 2.1 (LOW)
References: http://cvs.sourceforge.net/viewcvs.py/firehol/firehol/firehol.sh; http://secunia.com/advisories/13970; http://secunia.com/advisories/14102
CVE: CVE-2005-0227
Published: 2005-05-02
Description: PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php; http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7148&w=2
CVE: CVE-2005-0228
Published: 2005-05-02
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2004-1388.  Reason: This candidate is a duplicate of CVE-2004-1388.  Notes: All CVE users should reference CVE-2004-1388 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-0230
Published: 2005-05-02
Description: Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging."
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2064&w=2; http://secunia.com/advisories/19823; http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml
CVE: CVE-2005-0232
Published: 2005-05-02
Description: Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka "Fireflashing."
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0856&w=2; http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml; http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml
CVE: CVE-2005-0234
Published: 2005-05-02
Description: The International Domain Name (IDN) support in Safari 1.2.5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3280&w=2
CVE: CVE-2005-0235
Published: 2005-05-02
Description: The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3280&w=2; http://www.novell.com/linux/security/advisories/2005_31_opera.html
CVE: CVE-2005-0236
Published: 2005-05-02
Description: The International Domain Name (IDN) support in Omniweb 5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3280&w=2; http://www.securityfocus.com/bid/12461
CVE: CVE-2005-0237
Published: 2005-05-02
Description: The International Domain Name (IDN) support in Konqueror 3.2.1 on KDE 3.2.1 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html; http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031460.html; http://secunia.com/advisories/14162
CVE: CVE-2005-0238
Published: 2005-05-02
Description: The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html; http://www.securityfocus.com/bid/12461; http://www.shmoo.com/idn
CVE: CVE-2005-0239
Published: 2005-05-02
Description: viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.idefense.com/application/poi/display?id=191&type=vulnerabilities&flashstatus=false; http://www.kb.cert.org/vuls/id/502328; http://www.squirrelmail.org/plugin_view.php?id=54
CVE: CVE-2005-0240
Published: 2005-05-02
Description: Format string vulnerability in chdev on IBM AIX 5.2 allows local users to execute arbitrary code via format string specifiers in a command line argument, which is not properly handled when printing an error message.
CVSS Score: 7.2 (HIGH)
References: http://www-1.ibm.com/support/docview.wss?uid=isg1IY67455; http://www-1.ibm.com/support/docview.wss?uid=isg1IY67654; http://www.idefense.com/application/poi/display?type=vulnerabilities
CVE: CVE-2005-0241
Published: 2005-05-02
Description: The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
CVSS Score: 5.0 (MEDIUM)
References: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931; http://fedoranews.org/updates/FEDORA--.shtml; http://secunia.com/advisories/14091
CVE: CVE-2005-0244
Published: 2005-05-02
Description: PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://archives.postgresql.org/pgsql-hackers/2005-01/msg00922.php; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6082&w=2; http://secunia.com/advisories/12948
CVE: CVE-2005-0246
Published: 2005-05-02
Description: The intagg contrib module for PostgreSQL 8.0.0 and earlier allows attackers to cause a denial of service (crash) via crafted arrays.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.postgresql.org/pgsql-committers/2005-01/msg00401.php; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6082&w=2; http://secunia.com/advisories/12948