CVE-2016-1923

CVE-2016-1923 affects OpenJpeg (OpenJPEG) via a heap-based buffer overflow in opj_j2k_update_image_data in version 2016.1.18, permitting a remote attacker to trigger an out-of-bounds read and crash the app when parsing crafted JPEG 2000 images. Public advisories in the connected documents indicat...

Gentoo Security Advisory GLSA 201412-02

Gentoo Linux Local Security Checks GLSA 201412-02 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

CVE-2015-1923

CVE-2015-1923 affects IBM Tivoli Storage Manager FastBack Server (6.1.0.0–6.1.11.1). The vulnerability is a buffer overflow in the server, exploitable remotely via unspecified vectors, leading to a denial of service (daemon crash). ING: multiple sources document this flaw as a stack-based/heap bu...

SUSE SLED10 / SLES10 Security Update : nfs-utils (SUSE-SU-2013:0822-1)

This update fixes a DNS spoofing problem with NFS rpc-gssd. CVE-2013-1923bnc813464 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

SUSE SLES10 Security Update : nfs-utils (SUSE-SU-2013:1668-1)

nfs-utils receives hereby a LTSS roll-up security and bugfix update. - CVE-2013-1923: Allow DNS lookups to be avoided when determining kerberos identity of server. The NFSGSSDAVOIDDNS sysconfig variable must to be set for this to take full effect as some installations could be negatively affected...

CVE-2013-1923

CVE-2013-1923 concerns rpc-gssd in nfs-utils before 1.2.8, which performs reverse DNS resolution during GSSAPI authentication. This DNS spoofing could let an attacker read files that should be restricted by spoofing server names. The vulnerability is tied to the nfs-utils RPC GSSD component and i...

Ubuntu: Security Advisory (USN-1923-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.2 Security Update : nfs-client (SAT Patch Number 7717)

This update fixes a DNS spoofing problem with NFS rpc-gssd. CVE-2013-1923bnc813464 It also adds MOUNTDOPTIONS and GSSDOPTIONS to /etc/sysconfig/nfs. bnc818094, bnc816897 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

SuSE 10 Security Update : nfs-utils (ZYPP Patch Number 8569)

This update fixes a DNS spoofing problem with NFS rpc-gssd. CVE-2013-1923bnc813464 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid66553; scriptversion"1.6";...

CVE-2011-1923

The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-5095...

Design/Logic Flaw

The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-1923...

CVE-2011-1923

Technical details about CVE-2011-1923 (PolarSSL DH parameter validation flaw) are not present in the provided connected documents. Please monitor for updates; current sources reference related CVE-2011-5095 but do not disclose product/impact specifics here.

Secunia Research: RealNetworks Helix Server Credentials Disclosure Security Issue

====================================================================== Secunia Research 09/04/2012 - RealNetworks Helix Server Credentials Disclosure Security Issue - ====================================================================== Table of Contents Affected...

Design/Logic Flaw

master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service unhandled exception and daemon crash via a crafted Open-PDU request that triggers incorrect DisplayString processing, a different...

CVE-2012-1923

CVE-2012-1923 affects RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x. The issue is caused by storing credentials in cleartext in the flat-file database under adm_b_db\users, enabling local users to read sensitive passwords. Impact is disclosure of credentials with partial co...

MySQL 3.20.32 - 3.23.52 Weak Default Configuration

The version of MySQL installed on the remote host is 3.20.32 to 3.23.52. On Windows, the default configuration used in these versions is weak : - The database server binds to all network interfaces and can be reached from outside. CVE-2002-1921 - Logging is disabled, attackers will not be detecte...

CVE-2010-1923

CVE-2010-1923 affects Hi Web Wiesbaden Web 2.0 Social Network Freunde Community System. The vulnerability is a SQL injection in user.php that allows an attacker to inject SQL via the id parameter in the showgallery action , leading to possible arbitrary SQL execution. Documents consistently descr...

CVE-2010-1923

creationtimestamp| type| source ---|---|--- 2010-05-08 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/34014...

CVE-2009-1923

CVE-2009-1923 describes a heap-based buffer overflow in the Windows WINS service that can allow remote code execution on Windows 2000 SP4 and Windows Server 2003 SP2. The flaw occurs during WINS replication packet processing, where a buffer-length calculation leads to a heap overflow. Public refe...

Microsoft Windows WINS Server网络报文堆溢出漏洞（MS09-039）

BUGTRAQ ID: 35980 CVECAN ID: CVE-2009-1923 Microsoft Windows是微软发布的非常流行的操作系统。 Windows服务器上的WINS.exe进程用于为NetBIOS网络提供名称解析服务。在解析push请求时WINS服务将报文数据拷贝到了静态的堆缓冲区上。如果远程攻击者提供了特制的请求，就可以触发堆溢出，导致以SYSTEM权限执行任意代码。 Microsoft Windows Server 2003 SP2 Microsoft Windows 2000 Server SP4 临时解决方法： 在防火墙上屏蔽TCP 42和UDP 42端口。...