Luke Macken

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 1.1.3 Django versions 1.2.x prior to 1.2.4 Django versions 1.3.x prior to 1.3 beta 1 **Description** The administrative interface in Django does not properly restrict the use of the query string, allowing remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, such as the `created by password regex` parameter. **Recommendations** For Django versions prior to 1.1.3, update to version 1.1.3 or later. For Django versions 1.2.x prior to 1.2.4, update to version 1.2.4 or later. For Django versions 1.3.x prior to 1.3 beta 1, update to version 1.3 beta 1 or later.

**Name of the Vulnerable Software and Affected Versions** Django versions prior to 1.1.3 Django versions 1.2.x prior to 1.2.4 Django versions 1.3.x prior to 1.3 beta 1 **Description** The issue concerns the password reset functionality in django.contrib.auth. It does not validate the length of a string representing a base36 timestamp. This allows remote attackers to cause a denial of service via a URL that specifies a large base36 integer. **Recommendations** For versions prior to 1.1.3, update to version 1.1.3 or later. For versions 1.2.x prior to 1.2.4, update to version 1.2.4 or later. For versions 1.3.x prior to 1.3 beta 1, update to version 1.3 beta 1 or later.

Multiple integer overflows in (1) readbmp.c, (2) readgif.c, (3) readgif.c, (4) readmrf.c, (5) readpcx.c, (6) readpng.c,(7) readpnm.c, (8) readprf.c, (9) readtiff.c, (10) readxbm.c, (11) readxpm.c in zgv 5.8 allow remote attackers to execute arbitrary code via certain image headers that cause calculations to be overflowed and small buffers to be allocated, leading to buffer overflows. NOTE: CVE-2004-0994 and CVE-2004-1095 identify sets of bugs that only partially overlap, despite having the same developer. Therefore, they should be regarded as distinct.