CVE-2002-0827

CVE-2002-0827 affects pppd on UnixWare 7.1.1 and Open UNIX 8.0.0, enabling local users to gain root privileges via (1) ppptalk or (2) ppp. The description notes this is a different issue from CVE-2002-0824. No remediation or version details are provided in the supplied documents; exploitation sta...

CVE-2002-0832

Internet Explorer 5, 5.6, and 6 allows remote attackers to bypass cookie privacy settings and store information across browser sessions via the userData storeuserData feature...

CVE-2002-0833

CVE-2002-0833 concerns a buffer overflow in Eudora for Windows (notably versions 5.1.1 and 5.0-J) triggered by processing a malicious MIME multipart message with an excessively long boundary string. The vulnerability resides in the multipart boundary handling, allowing remote attackers to potenti...

CVE-2002-0825

CVE-2002-0825 describes a buffer overflow in the DNS SRV code used by nss_ldap when configuring via DNS SRV records. The issue affects nss_ldap versions prior to 198 (also related to 199 for data length handling) and can allow remote attackers to cause a denial of service and potentially execute ...

CVE-2002-0825

Buffer overflow in the DNS SRV code for nssldap before nssldap-198 allows remote attackers to cause a denial of service and possibly execute arbitrary code...

[SECURITY] [DSA 144-1] New wwwoffle packages fix security related problems

-------------------------------------------------------------------------- Debian Security Advisory DSA 144-1 [email protected] http://www.debian.org/security/ Martin Schulze August 6th, 2002 - -------------------------------------------------------------------------- Package : wwwoffle...

CVE-2002-0821

CVE-2002-0821 affects Ethereal (now Wireshark) 0.9.4 and earlier, where buffer overflows in the BGP and WCP dissectors allow remote attackers to cause a denial of service or possibly execute arbitrary code. Connected sources confirm the affected component and version, and describe the root cause ...

CVE-2002-0822

CVE-2002-0822 affects Ethereal 0.9.4 and earlier. The vulnerability exists in the SOCKS , RSVP , AFS , and LMP dissectors, which can be forced to core dump, potentially allowing remote an attacker to execute arbitrary code. Public sources within the connected documents confirm the impact as remot...

CVE-2002-0819

CVE-2002-0819 describes a format-string vulnerability in the artsd component when invoked via artswrapper. The flaw allows local users to gain privileges through improper handling of format strings in the -a argument, leading to privilege escalation via an error message call path to arts_fatal. A...

CVE-2002-1616

Multiple buffer overflows in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allow local users to gain root privileges via 1 su, 2 chsh, 3 passwd, 4 chfn, 5 dxchpwd, and 6 libc...

CVE-2002-1446

The error checking routine used for the CVerify call on a symmetric verification key in the nCipher PKCS11 library 1.2.0 and later returns the CKROK status even when it detects an invalid signature, which could allow remote attackers to modify or forge messages...

CVE-2002-0815

The CVE-2002-0815 entry describes a vulnerability in the Javascript Same Origin Policy (SOP) as implemented by Netscape, Mozilla, and Internet Explorer. The root cause is that code running in one frame can access content from a restricted site due to the ability to map the attacker’s parent domai...

CVE-2002-0807

CVE-2002-0807: Cross-site scripting in Bugzilla affects versions 2.14 before 2.14.2 and 2.16 before 2.16rc2. Root cause: the real name field is not properly quoted by editusers.cgi, allowing remote attackers to run script as other Bugzilla users. Impact: partial confidentiality/integrity/availabi...

CVE-2002-0655

OpenSSL CVE-2002-0655 affects 0.9.6d and earlier and 0.9.7-beta2 and earlier; on 64-bit platforms it mishandles ASCII representations of integers, enabling denial of service and potentially arbitrary code execution. Public sources in the connected docs corroborate multiple related CVEs (0655, 065...

CVE-2002-0811

CVE-2002-0811 affects Bugzilla: versions 2.14 before 2.14.2 and 2.16 before 2.16rc2. The vulnerability allows remote attackers to cause a denial of service or execute certain queries via a SQL injection in the sort order parameter of buglist.cgi. Connected sources also link multiple related CVEs ...

CVE-2002-0656

OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, are affected by buffer overflow vulnerabilities that allow remote code execution via two vectors: (1) oversized client master key in SSL2 and (2) oversized session ID in SSL3. The CVE entry CVE-2002-0656 is the primary issue. Affected produ...

CVE-2002-0684

CVE-2002-0684 describes a buffer overflow in the DNS resolver logic used by BIND 4.9.8 and ported to glibc 2.2.5 and earlier. The flaw occurs in resolver/DNS name resolution (getnetbyname/getnetbyaddr) and can allow a remote attacker sending crafted DNS responses to execute arbitrary code. Severa...

CVE-2002-0657

OpenSSL 0.9.7 before beta3 with Kerberos enabled is vulnerable to a buffer overflow triggered by a long master key, allowing potential remote arbitrary code execution. This CVE (CVE-2002-0657) is described in the initial document as affecting OpenSSL 0.9.7 prior to 0.9.7-beta3 and enabling Kerber...

CVE-2002-0657

Buffer overflow in OpenSSL 0.9.7 before 0.9.7-beta3, with Kerberos enabled, allows attackers to execute arbitrary code via a long master key...

CVE-2002-0655

OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a denial of service and possibly execute arbitrary code...