132 matches found
Neon XML文档解析拒绝服务漏洞
BUGTRAQ ID: 36080 CVECAN ID: CVE-2009-2473 neon是一款HTTP和WebDAV客户端库。 如果使用了expat库，neon在实体扩展期间没有正确的检测递归。当客户端应用访问恶意的DAV服务器或使用XML解析接口（nexml）解析XML文档的时候，包含有大量嵌套实体引用的特制XML文档就可能耗尽大量内存和CPU资源。 Neon Client Library 0.28.6 厂商补丁： Neon ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
[ MDVSA-2009:221 ] libneon0.27
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:221 http://www.mandriva.com/security/ Package : libneon0.27 Date : August 24, 2009 Affected: 2008.1, 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has bee...
Fedora 11 : neon-0.28.6-1.fc11 (2009-8815)
This update includes the latest release of neon, version 0.28.6. This fixes two security issues: the 'billion laughs' attack against expat could allow a Denial of Service attack by a malicious server. CVE-2009-2473 an embedded NUL byte in a certificate subject name could allow an undetected MITM...
Fedora 10 : neon-0.28.6-1.fc10 (2009-8794)
This update includes the latest release of neon, version 0.28.6. This fixes two security issues: the 'billion laughs' attack against expat could allow a Denial of Service attack by a malicious server. CVE-2009-2473 an embedded NUL byte in a certificate subject name could allow an undetected MITM...
CVE-2009-2473
Technical details for CVE-2009-2473 are not publicly available in the provided documents. Monitor for updates from official advisories.
CVE-2009-2473
neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...
CVE-2009-2473
neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...
CVE-2007-2473
CVE-2007-2473 describes an SQL injection in the stylesheet.php file of CMS Made Simple, affecting version 1.0.5 and earlier. The vulnerability allows remote attackers to execute arbitrary SQL commands by supplying a crafted value for the templateid parameter. The available connected documents con...
CVE-2006-2473
CVE-2006-2473 : OpenWiki 0.78 contains a cross-site scripting (XSS) vulnerability in the ow.asp file, exploitable via the p parameter. The issue, which the vendor disputes (claims that inputs are escaped and cannot be used to inject code), is documented across multiple sources (NVD, CVE list, PRI...
CVE-2004-2473
Technical details for CVE-2004-2473 are not publicly available in the provided documents; the entries summarize a local symlink-related overwrite vulnerability without product/version specifics beyond wmFrog 0.1.6 prior to 0.2.0.
CVE-2005-2473
The CVE-2005-2473 entry concerns ChurchInfo and documents multiple SQL injection vulnerabilities in which an attacker can cause remote execution of arbitrary SQL via the PersonID parameter to several PHP scripts (PersonView.php, MemberRoleChange.php, PropertyAssign.php, WhyCameEditor.php, GroupPr...
