180 matches found
CVE-2008-2237
Heap-based buffer overflow in OpenOffice.org OOo 2.x before 2.4.2 allows remote attackers to execute arbitrary code via a crafted WMF file associated with a StarOffice/StarSuite document...
CVE-2008-2237
CVE-2008-2237 describes a heap-based overflow in the OpenOffice.org WMF image handling that could allow remote code execution via a crafted WMF file. Affected: OpenOffice.org 2.x up to 2.4.2. The issue also relates to similar integer overflow/heap overflow flaws in the EMF parser (CVE-2008-2238)....
[SECURITY] [DSA 1661-1] New OpenOffice.org packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 1661-1 [email protected] http://www.debian.org/security/ Martin Schulze October 29th, 2008 http://www.debian.org/security/faq -...
DSA-1661-1 openoffice.org - several vulnerabilities
Bulletin has no description...
OpenOffice < 2.4.2 WMF and EMF File Handling Buffer Overflows
The version of OpenOffice 2.x installed on the remote host is earlier than 2.4.2. Such versions are affected by several issues : - Specially crafted WMF files can lead to heap-based overflows and arbitrary code execution CVE-2008-2237. - Specially crafted EMF files can lead to heap-based overflow...
Gentoo Security Advisory GLSA 200606-06 (awstats)
The remote host is missing updates announced in advisory GLSA 200606-06. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
Debian Security Advisory DSA 1058-1 (awstats)
The remote host is missing an update to awstats announced via advisory DSA 1058-1. Hendrik Weimer discovered that specially crafted web requests can cause awstats, a powerful and featureful web server log analyzer, to execute arbitrary commands. The old stable distribution woody is not affected b...
openSUSE 10 Security Update : awstats (awstats-1612)
This update fixes remote code execution vulnerabilities in awstats. Since backporting awstats fixes is error prone we have upgraded it to upstream version 6.6, which also includes new features. Security issues fixed: - CVE-2006-2237: missing sanitizing of the 'migrate' parameter. 173041 -...
CVE-2002-2237
CVE-2002-2237 affects TFTPD32 TFTP server 2.21 and earlier, allowing remote denial of service via a GET request containing a DOS device name (e.g., com1/aux). The CERT advisory associates this with Wyse TFTPD32 in Wyse Simple Imager (WSI) and lists a fixed version path: 2.51 for this CVE, with WS...
Code injection
Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service crash via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237...
Microsoft Windows - GDI+ .ICO File Remote Denial of Service
Microsoft Windows - GDI+ .ICO File Remote Denial of Service Author : kad Mail : kadathighsecudotcom Site : http://www.highsecu.com highsecu.ico - Microsoft GDI+ Integer division by zero flaw handling .ICO files...
CVE-2007-2237
The CVE-2007-2237 entry concerns gdiplus.dll (GDI+) in Microsoft Windows. Affected component is the ICO file handling path, specifically an ICO InfoHeader with a Height of zero. The underlying flaw triggers a divide-by-zero error in GdiPlus.dll, enabling a context-dependent attacker to cause a de...
SUSE-SA:2006:033: awstats
The remote host is missing the patch for the advisory SUSE-SA:2006:033 awstats. This update fixes remote code execution vulnerabilities in the WWW statistical analyzer awstats. Since back porting awstats fixes is error prone we have upgraded it to upstream version 6.6 which also includes new...
[SECURITY] [DSA 1058-1] New awstats packages fix arbitrary command execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 1058-1 [email protected] http://www.debian.org/security/ Martin Schulze May 18th, 2006 http://www.debian.org/security/faq -...
AWStats migrate parameter command injection
Added: 05/11/2006 CVE: CVE-2006-2237 BID: 17844 OSVDB: 25284 Background AWStats is a web application for showing web, FTP, and mail server statistics. Problem AWStats uses the value of the migrate input parameter in a PERL open call without sufficient checks for invalid characters, allowing remot...
AWStats migrate parameter command injection
Added: 05/11/2006 CVE: CVE-2006-2237 BID: 17844 OSVDB: 25284 Background AWStats is a web application for showing web, FTP, and mail server statistics. Problem AWStats uses the value of the migrate input parameter in a PERL open call without sufficient checks for invalid characters, allowing remot...
CVE-2006-2237
AWStats 6.4 and 6.5 are affected by CVE-2006-2237 due to missing sanitization of the migrate parameter, enabling remote code execution when statistics updates are enabled. Evidence from multiple advisories and exploit records shows an external attacker could run arbitrary commands via the migrate...
AWStats migrate Parameter Arbitrary Command Execution
The remote host is running AWStats, a free logfile analysis tool written in Perl. The version of AWStats installed on the remote host fails to sanitize input to the 'migrate' parameter before passing it to a Perl 'open' function. Provided 'AllowToUpdateStatsFromBrowser' is enabled in the AWStats...
CVE-2004-2237
Technical details for CVE-2004-2237 are not publicly available in the provided documents. Monitor for updates and expect future disclosures before any assessment of impact or remediation.