Two vulnerabilities have been reported in cPanel, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to manipulate certain data.

1) An error in the splitlogs binary when handling log messages can be exploited to write to arbitrary files on the system via specially crafted log messages containing directory traversal sequences.

Successful exploitation of this vulnerability requires that the Apache Piped Log Configuration is used (disabled by default).

2) An error due to the cPanel WebDAV (cPDAVd) not properly sanitising filenames can be exploited to execute arbitrary code.

The vulnerabilities are reported in versions prior to 11.30.6.8, 11.32.2.28, and 11.32.3.19.

Solution
Update to version 11.30.6.8, 11.32.2.28, or 11.32.3.19.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.cpanel.net/2012/05/targeted-security-release-20120531-announcement.html
http://www.cpanel.net/2012/06/targeted-security-release-2012-05-31-disclosure.html

Deep Links
Links available to Secunia VIM customers