iDefense Security Advisory 10.25.07: Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability

Trend Micro Tmxpflt.sys IOCTL 0xa0284403 Buffer Overflow Vulnerability iDefense Security Advisory 10.25.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 25, 2007 I. BACKGROUND The Trend Micro AntiVirus scan engine provides AntiVirus capabilities to desktop, server, and gateway system...

Unfixed XSS vulnerability at www.moviemistakes.com

Security researcher unkn0wn @ toxcrew.com, has submitted on 26/10/2007 a cross-site-scripting XSS vulnerability affecting www.moviemistakes.com, which at the time of submission ranked 34115 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

Unfixed XSS vulnerability at archive.stsci.edu

Security researcher unkn0wn @ toxcrew.com, has submitted on 26/10/2007 a cross-site-scripting XSS vulnerability affecting archive.stsci.edu, which at the time of submission ranked 49019 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007...

CVE-2007-2983

CVE-2007-2983 affects the British Telecommunications Consumer webhelper ActiveX control (btwebcontrol.dll) prior to version 2.0.0.8. Multiple buffer overflows enable remote code execution via unspecified vectors. The vulnerability resides in the ActiveX control used by BT’s web helper. Exploitati...

php malformed cookie handling

Unspecified vulnerability in PHP before 5.2.4 has unknown impact and attack vectors, related to an "Improved fix for MOPB-03-2007," probably a variant of CVE-2007-1285...

[SECURITY] [DSA 1395-1] New xen-utils packages fix file truncation

------------------------------------------------------------------------ Debian Security Advisory DSA 1395-1 [email protected] http://www.debian.org/security/ Steve Kemp October 25th, 2007 http://www.debian.org/security/faq -...

JVN#50495547 Ichitaro series buffer overflow vulnerability

The "Ichitaro" series word processing software, from JustSystems Corporation, contains a buffer overflow vulnerability. If a user opens a specially crafted jtd file or views it on a web browser, an attacker could execute arbitrary code with the privileges of the user. Impact An attacker could...

Unfixed XSS vulnerability at www.dii.unisi.it

Security researcher Langy, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.dii.unisi.it, which at the time of submission ranked 75542 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is currently...

Unfixed XSS vulnerability at www.fritolay.com.tr

Security researcher Kara, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.fritolay.com.tr, which at the time of submission ranked 1025999 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is...

Unfixed XSS vulnerability at www.gmail.it

Security researcher Langy, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.gmail.it, which at the time of submission ranked 421085 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is currently...

CentOS 4 / 5 : firefox (CESA-2007:0979)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way i...

openSUSE 10 Security Update : fetchmail (fetchmail-4490)

This update fixes a remote denial-of-service attack. CVE-2007-4565 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update fetchmail-4490. The text description of this plugin is C SUSE LLC...

Debian DSA-1391-1 : icedove - several vulnerabilities

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird client. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3734 Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz, Jesse...

Debian DSA-1389-2 : zoph - missing input sanitising

It was discovered that zoph, a web-based photo management system, performs insufficient input sanitising, which allows SQL injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1389...

CentOS 3 : openssl (CESA-2007:0813)

Updated OpenSSL packages that correct security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport...

RHEL 2.1 / 3 / 4 : seamonkey (RHSA-2007:0980)

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client...

RHEL 4 / 5 : flac (RHSA-2007:0975)

An updated flac package to correct a security issue is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. FLAC is a Free Lossless Audio Codec. The flac package consists of a FLAC encoder and...

Unfixed XSS vulnerability at harzack.freeshell.org

Security researcher Langy, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting harzack.freeshell.org, which at the time of submission ranked 65641 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is...

Unfixed XSS vulnerability at www.newsday.com

Security researcher Skunkfoot, has submitted on 25/10/2007 a cross-site-scripting XSS vulnerability affecting www.newsday.com, which at the time of submission ranked 7002 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 04/11/2007. It is current...

GLSA-200710-27 : ImageMagick: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200710-27 ImageMagick: Multiple vulnerabilities regenrecht reported multiple infinite loops in functions ReadDCMImage and ReadXCFImage CVE-2007-4985, multiple integer overflows when handling certain types of images CVE-2007-4986,...