CVE-2006-6917

CA BrightStor ARCserve Backup R11.5 Server before SP2 contains multiple buffer overflows in the Tape Engine (tapeeng.exe) via crafted RPC requests targeting opnum 38 (TAPEUTIL.dll 11.5.3884.0) or opnum 37 (TAPEENG.dll 11.5.3884.0). The vulnerability allows remote attackers to execute arbitrary co...

Moderate: Red Hat Security Advisory: libgsf security update

Updated libgsf packages that fix a buffer overflow flaw are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The GNOME Structured File Library is a utility library for reading and writing structured file formats. A heap based buff...

CVE-2006-6916

CVE-2006-6916 affects Getahead Direct Web Remoting (DWR) prior to 1.1.3. The provided connected Red Hat entry corroborates that attackers can cause a denial of service (infinite loop) via crafted input. The exact root cause, vulnerable component(s) within DWR, affected versions beyond the stated ...

CentOS 3 : XFree86 (CESA-2007:0002)

Updated XFree86 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having important security impact by the Red Hat Security Response Team. XFree86 is an implementation of the X Window System, which provides the core...

RHEL 2.1 / 3 : XFree86 (RHSA-2007:0002)

Updated XFree86 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having important security impact by the Red Hat Security Response Team. XFree86 is an implementation of the X Window System, which provides the core...

XFree86 security update

CentOS Errata and Security Advisory CESA-2007:0002 Updated XFree86 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having important security impact by the Red Hat Security Response Team. XFree86 is an implementation of the...

CVE-2006-5858

CVE-2006-5858 affects Adobe ColdFusion MX 7–7.0.2 and JRun 4 when run on Microsoft IIS. The vulnerability allows remote attackers to read arbitrary files, list directories, or read source code by sending a double URL-encoded NULL byte in a ColdFusion filename (e.g., a .cfm file). This is a server...

CVE-2006-5857

Adobe Reader/Acrobat Reader 7.0.8 and earlier is affected by CVE-2006-5857 (plus related CVEs) via memory corruption that overwrites a subroutine pointer during PDF rendering, enabling code execution. Red Hat advisories RHSA-2007-0017 and RHSA-2007-0021 describe updates to Adobe Reader that fix t...

CVE-2007-0161

The PML Driver HPZ12 HPZipm12.exe in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICECHANGECONFIG DACL permissions, which allows local users to gain privileges and execute arbitrary programs, as demonstrated by modifying the binpath argument, a related issue to...

Design/Logic Flaw

The PML Driver HPZ12 HPZipm12.exe in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICECHANGECONFIG DACL permissions, which allows local users to gain privileges and execute arbitrary programs, as demonstrated by modifying the binpath argument, a related issue to...

iDefense Security Advisory 01.09.07: Multiple Vendor X Server Render Extension ProcRenderAddGlyphs Memory Corruption Vulnerability

Multiple Vendor X Server Render Extension ProcRenderAddGlyphs Memory Corruption Vulnerability iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007 I. BACKGROUND The X Window System is a graphical windowing system based on a client/server model...

CVE-2006-6144

CVE-2006-6144 concerns the GSS-API mechglue in MIT Kerberos 5. The vulnerability affects Kerberos 5 implementations using the mechglue abstraction (Kerberos 5 up to 1.5.1, as used by kadmind and other products that rely on the GSS-API library). The issue is that a remote attacker can trigger a de...

CVE-2006-6915

CVE-2006-6915 affects ftpd in IBM AIX 5.2.0 and 5.3.0. The vulnerability allows remote authenticated users to cause a denial of service (port exhaustion) via unspecified vectors. Details are sourced from the CVE entry and third-party reports; no explicit exploit information or affected version ra...

iDefense Security Advisory 01.09.07: Multiple Vendor X Server DBE Extension ProcDbeGetVisualInfo Memory Corruption Vulnerability

Multiple Vendor X Server DBE Extension ProcDbeGetVisualInfo Memory Corruption Vulnerability iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007 I. BACKGROUND The X Window System is a graphical windowing system based on a client/server model. Mor...

CVE-2006-6143

CVE-2006-6143 is a vulnerability in the RPC library used by MIT Kerberos 5 (krb5) and kadmind. The root cause is an uninitialized function pointer that is referenced in freed memory, which can allow a remote attacker to trigger a crash and, possibly, execute arbitrary code. The issue affects Kerb...

phpMyFAQ < 1.6.8 Multiple SQL Injection Vulnerabilities

The version of phpMyFAQ on the remote host does not properly validate input to the 'uin' parameter of several scripts before using it in database queries. An unauthenticated, remote attacker may be able to leverage these issues to launch SQL injection attacks against the affected application, eve...

[Full-disclosure] Adobe Reader Remote Heap Memory Corruption - Subroutine Pointer Overwrite

Adobe Reader Remote Heap Memory Corruption - Subroutine Pointer Overwrite by Piotr Bania [email protected] http://www.piotrbania.com Orginal url: http://www.piotrbania.com/all/adv/adobe-acrobat-adv.txt Severity: Critical - Possible remote code execution. CVE ID: CVE-2006-5857 Time line:...

iDefense Security Advisory 01.09.07: Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability

Adobe Macromedia ColdFusion Source Code Disclosure Vulnerability iDefense Security Advisory 01.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2007 I. BACKGROUND Adobe Macromedia ColdFusion is an application server and development framework for websites. More information is...

CVE-2006-6103

CVE-2006-6103 involves an integer overflow in the ProcDbeSwapBuffers function within the X.Org DBE extension (covering X.Org 6.8.2, 6.9.0, 7.0, 7.1 and the XFree86 X server). The overflow can cause memory corruption when processing data structures, enabling a local attacker to potentially execute...

CVE-2006-6102

The CVE-2006-6102 entry involves an integer overflow in the ProcDbeGetVisualInfo path of the X.Org DBE extension (affecting X.Org 6.8.2–7.1 and the XFree86 X server). The vulnerability allows local users to trigger memory corruption through a crafted X protocol request, potentially leading to arb...