Weekly Vulnerabilities Reports > July 18 to 24, 2005

Overview

3 new vulnerabilities reported during this period, including 1 critical vulnerabilities and 1 high severity vulnerabilities. This weekly summary report vulnerabilities in 6 products from 5 vendors including Apple, Debian, Oracle, MIT, and Juvare. Vulnerabilities are notably categorized as "Incomplete Cleanup", "Inadequate Encryption Strength", and "Double Free".

  • 2 reported vulnerabilities are remotely exploitables.
  • 1 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 2 reported vulnerabilities are exploitable by an anonymous user.
  • Apple has the most reported vulnerabilities, with 1 reported vulnerabilities.
  • Apple has the most reported critical vulnerabilities, with 1 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

1 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-07-18 CVE-2005-1689 MIT
Apple
Debian 		Double Free vulnerability in multiple products

Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.
9.8

1 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-07-18 CVE-2005-2281 Juvare Inadequate Encryption Strength vulnerability in Juvare Webeoc

WebEOC before 6.0.2 uses a weak encryption scheme for passwords, which makes it easier for attackers to crack passwords.
7.5

1 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2005-07-18 CVE-2005-2293 Oracle Incomplete Cleanup vulnerability in Oracle Forms Builder 9.0.4

Oracle Formsbuilder 9.0.4 stores database usernames and passwords in a temporary file, which is not deleted after it is used, which allows local users to obtain sensitive information.
5.5

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS