CVE-2005-3505

CVE-2005-3505 describes a cross-site scripting (XSS) flaw in the Entropy Chat script used by cPanel versions 10.2.0-R82 and 10.6.0-R137. The underlying issue is that a chat message containing JavaScript in style attributes within tags such as can be processed by Internet Explorer, enabling remot...

CVE-2005-2753

CVE-2005-2753 affects Apple QuickTime prior to 7.0.3. An integer overflow in parsing MOV files causes a sign-extension error in a Pascal-style string, enabling user-assisted or remote code execution when a crafted MOV is opened. Impact is remote code execution with the attacker’s code running wit...

CVE-2005-3500

CVE-2005-3500 affects ClamAV prior to 0.87.1. The tnef_attachment() function in tnef.c can cause a denial of service by an attacker sending a crafted CAB file that triggers an infinite loop and memory exhaustion by forcing ClamAV to repeatedly scan the same block. Public sources in the connected ...

CVE-2005-3503

CVE-2005-3503 affects chfn in pwdutils

CVE-2005-3501

CVE-2005-3501 affects ClamAV before 0.87.1 via the cabd_find path in libmspack (cab d.c) where a crafted CAB file causes cabd_find to be called with a zero length, leading to a denial of service (infinite loop). The vulnerability is tied to ClamAV's libmspack CAB handling; upgrade to 0.87.1 or la...

CVE-2005-3506

CVE-2005-3506 describes a cross-site scripting vulnerability in Sambar Server 6.3 BETA 2 (and possibly earlier versions) in the proxy.asp component. The issue allows remote attackers to inject arbitrary web script or HTML via the Remote Proxy Server or Proxy Filter IPs fields. The provided docume...

CVE-2005-3502

The CVE-2005-3502 entry concerns Cerberus Helpdesk: the attachment_send.php component is vulnerable to an unauthorized access flaw where a modified file_id parameter lets remote attackers view attachments and tickets of other users. The available sources confirm the affected product and the acces...

CVE-2005-2628

CVE-2005-2628 concerns a buffer overflow in Macromedia Flash Player (Flash.ocx) for Flash 6/7. The issue arises from insufficient validation of SWF data, allowing a remote attacker to execute arbitrary code via a crafted SWF file. Red Hat’s RHSA-2005:835 notes the fix in updated Macromedia Flash ...

CVE-2005-2756

CVE-2005-2756 corresponds to a buffer overflow in Apple QuickTime PictureViewer that allows remote code execution when processing crafted PICT data. Affected: QuickTime before 7.0.3 (Mac and Windows). Root cause: lack of input validation during decompression of compressed PICT data, causing memor...

CVE-2005-3505

Cross-site scripting XSS vulnerability in the Entropy Chat script in cPanel 10.2.0-R82 and 10.6.0-R137 allows remote attackers to inject arbitrary web script or HTML via a chat message containing Javascript in style attributes in tags such as , which are processed by Internet Explorer...

CVE-2005-3500

The tnefattachment function in tnef.c for Clam AntiVirus ClamAV before 0.87.1 allows remote attackers to cause a denial of service infinite loop and memory exhaustion via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block...

CVE-2005-3501

The cabdfind function in cabd.c of the libmspack library mspack for Clam AntiVirus ClamAV before 0.87.1 allows remote attackers to cause a denial of service infinite loop via a crafted CAB file that causes cabdfind to be called with a zero length...

CVE-2005-3303

Vulnerability CVE-2005-3303 affects ClamAV versions 0.80–0.87 via the FSG unpacker (fsg.c). A crafted FSG 1.33 file can trigger memory corruption, enabling remote code execution. The description specifies memory corruption as the vector and mentions arbitrary code execution; no explicit patch ver...

CVE-2005-2754

CVE-2005-2754 refers to an integer overflow in Apple QuickTime before 7.0.3 that can enable remote code execution when a crafted MOV file with “Improper movie attributes” is loaded. The issue is documented across multiple sources as affecting QuickTime on Mac OS X and Windows, with the overflow p...

[SECURITY] [DSA 883-1] New thttpd packages fix insecure temporary file

-------------------------------------------------------------------------- Debian Security Advisory DSA 883-1 [email protected] http://www.debian.org/security/ Martin Schulze November 4th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 882-1] New OpenSSL packages fix cryptographic weakness

-------------------------------------------------------------------------- Debian Security Advisory DSA 882-1 [email protected] http://www.debian.org/security/ Martin Schulze November 4th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 881-1] New OpenSSL 0.9.6 packages fix cryptographic weakness

-------------------------------------------------------------------------- Debian Security Advisory DSA 881-1 [email protected] http://www.debian.org/security/ Martin Schulze November 4th, 2005 http://www.debian.org/security/faq -...

DEBIAN-CVE-2005-3350

libungif library before 4.1.0 allows attackers to corrupt memory and possibly execute arbitrary code via a crafted GIF file that leads to an out-of-bounds write...

CVE-2005-3350

libungif library before 4.1.0 allows attackers to corrupt memory and possibly execute arbitrary code via a crafted GIF file that leads to an out-of-bounds write...

CVE-2005-3493

CVE-2005-3493 describes a denial-of-service vulnerability in Battle Carry versions up to 0.005, where remote attackers can send a large UDP packet that triggers a socket error and terminates the server's UDP listening socket. The provided documents do not include exploit details, affected product...