Core Security Technologies Advisory 2007.0817

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies – CoreLabs Advisory http://www.coresecurity.com/corelabs Remote command execution, HTML and JavaScript injection vulnerabilities in AOL’s Instant Messaging software Advisory Information Title: Remote Command execution, HTML...

CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL's Instant Messaging software

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies – CoreLabs Advisory http://www.coresecurity.com/corelabs Remote command execution, HTML and JavaScript injection vulnerabilities in AOL’s Instant Messaging software Advisory Information Title: Remote Command execution, HTML...

Lianzhong game lobby GlobalLink glItemCom.dll SetInfo()use analyze-vulnerability warning-the black bar safety net

author: voidph4nt0m.org pub: 2008-09-04 http://www.ph4nt0m.org Text Mode Affected version: Lianzhong game lobby 2. 7. 0. 8 2 0 0 7 years 8 months 1 6, released Unaffected version: Ourgame also didn't fill :- Genesis: With all the programmers are too trusting user input,not detecting the user...

Quiksoft EasyMail SMTP ActiveX control stack buffer overflow vulnerabilities

Overview The Quiksoft EasyMail SMTP ActiveX control contains multiple stack buffer overflow vulnerabilities, which could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Quiksoft EasyMail Objects is a set of ActiveX controls that provides emai...

Microsoft Security Bulletin MS07-045 - Critical Cumulative Security Update for Internet Explorer (937143)

Microsoft Security Bulletin MS07-045 - Critical Cumulative Security Update for Internet Explorer 937143 Published: August 14, 2007 Version: 1.0 General Information Executive Summary This critical security update resolves three privately reported vulnerabilities. These vulnerabilities could allow...

Security on AIR: Local file access through JavaScript

Hi! It's just a very first look to AIR Adobes Integrated Runtime and its possibilities to process HTML/JS. AIR is beta by now, so Adobe may change things in the final release. What is AIR? Quote from Adobe: "Adobe Integrated Runtime AIR is a cross- operating system runtime that allows you to...

Microsoft Security Bulletin MS07-033 - Critical Cumulative Security Update for Internet Explorer (933566)

Microsoft Security Bulletin MS07-033 - Critical Cumulative Security Update for Internet Explorer 933566 Published: June 12, 2007 Version: 1.0 General Information Executive Summary This critical security update resolves five privately reported vulnerabilities and one publicly disclosed...

RHEL 5 : squid (RHSA-2007:0131)

An updated squid package that fixes a security vulnerability is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Squid is a high-performance proxy caching server for Web clients, supporting FTP,...

Microsoft Security Bulletin MS07-024 Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (934232)

Microsoft Security Bulletin MS07-024 Vulnerabilities in Microsoft Word Could Allow Remote Code Execution 934232 Published: May 8, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Word Impact of Vulnerability: Remote Code Execution Maximum Severity Rating:...

Microsoft Security Bulletin MS07-026 Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (931832)

Microsoft Security Bulletin MS07-026 Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution 931832 Published: May 8, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Exchange Server Impact of Vulnerability: Remote Code Execution Maximum Severit...

Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768)

Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer 931768 Published: May 8, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical...

RHEL 4 : gdb (RHSA-2007:0229)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2007:0229 advisory. GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and then printin...

Mandrake Linux Security Advisory : postgresql (MDKSA-2007:094)

A weakness in previous versions of PostgreSQL was found in the security definer functions in which an authenticated but otherwise unprivileged SQL user could use temporary objects to execute arbitrary code with the privileges of the security-definer function. IMPORTANT NOTICE FOR CORPORATE...

Hack attack: in a WEB application hidden Backdoor-vulnerability warning-the black bar safety net

In many commercial programs,the programmer might, for some purposes, in the program left by the back door. We do not discuss the purpose of doing so is what, just talk about how in the program to hide an“ultimate back door.” First of all for everyone to see an example, last year I wrote an articl...

Cookie Delivery processes and security issues-vulnerability warning-the black bar safety net

Cookie in English is a small dessert of meaning, and the word we are always in the browser to see the food how it will tell the browser about the relationship? As you browse the previous landing sites might appears on the website: Hello XX, feel very homely, it is like eating a small dessert. Thi...

GLSA-200702-12 : CHMlib: User-assisted remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200702-12 CHMlib: User-assisted remote execution of arbitrary code When certain CHM files that contain tables and objects stored in pages are parsed by CHMlib, an unsanitized value is passed to the alloca function resulting in a...

Cisco Security Advisory: Multiple Vulnerabilities in Firewall Services Module

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in Firewall Services Module Advisory ID: cisco-sa-20070214-fwsm http://www.cisco.com/warp/public/707/cisco-sa-20070214-fwsm.shtml Revision 1.0 For Public Release 2007 February 14 1600 UTC GMT -...

Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090)

Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer 928090 Published: February 13, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Windows Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Critical...

Microsoft MFC component vulnerable to remote code execution via malformed embedded OLE object

Overview A memory corruption vulnerability exists in the MFC component that is provided with Microsoft Windows and Visual Studio Description The Microsoft Foundation Class Library MFC, is a Microsoft library that wraps parts of the Windows API in C++ classes. MFC is included in Microsoft Visual...

Microsoft Windows fails to properly handle malformed OLE objects embedded in RTF documents

Overview A vulnerability in the way that Microsoft Windows handles OLE objects embedded within RTF documents may allow an attacker to execute arbitrary code. Description Microsoft Object Linking and Embedding OLE is a technology that allows applications to create and edit compound documents...