MS11-006: Vulnerability in Windows Shell Graphics Processing Could Allow Remote Code Execution (2483185)

If a remote attacker can trick a user on the affected host into opening a specially crafted bitmap file, a vulnerability in the graphics rendering engine that arises due to its failure to validate the 'biClrUsed' parameter could be leveraged to execute arbitrary code on the host subject to the...

Windows Thumbnail View CreateSizedDIBSECTION buffer overflow

Added: 01/14/2011 CVE: CVE-2010-3970 BID: 45662 OSVDB: 70263 Background The shimgvw.dll library is part of the Microsoft Graphics Rendering Engine. Problem A vulnerability in shimgvw.dll allows command execution when Windows renders a thumbnail image which passes a specially crafted biClrUsed...

Windows Thumbnail View CreateSizedDIBSECTION buffer overflow

Added: 01/14/2011 CVE: CVE-2010-3970 BID: 45662 OSVDB: 70263 Background The shimgvw.dll library is part of the Microsoft Graphics Rendering Engine. Problem A vulnerability in shimgvw.dll allows command execution when Windows renders a thumbnail image which passes a specially crafted biClrUsed...

Windows Thumbnail View CreateSizedDIBSECTION buffer overflow

Added: 01/14/2011 CVE: CVE-2010-3970 BID: 45662 OSVDB: 70263 Background The shimgvw.dll library is part of the Microsoft Graphics Rendering Engine. Problem A vulnerability in shimgvw.dll allows command execution when Windows renders a thumbnail image which passes a specially crafted biClrUsed...

Microsoft Windows graphics engine thumbnail stack buffer overflow

Overview Microsoft Windows contains a stack-based buffer overflow vulnerability in the graphics rendering engine, which may allow an attacker to execute arbitrary code. Description Microsoft Windows contains a stack-based buffer overflow vulnerability caused by a signedness error in the...

CVE-2010-3970

Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor aka graphics rendering engine in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary...

CVE-2010-3970

CVE-2010-3970 is a stack-based buffer overflow in CreateSizedDIBSECTION within shimgvw.dll (Windows Shell Graphics Processing). It is triggered by a crafted thumbnail bitmap (e.g., via a negative biClrUsed value) and can allow remote code execution. Affected products include Windows XP SP2/SP3, S...

MS11-006 Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow

This module exploits a stack-based buffer overflow in the handling of thumbnails within .MIC files and various Office documents. When processing a thumbnail bitmap containing a negative 'biClrUsed' value, a stack-based buffer overflow occurs. This leads to arbitrary code execution. In order to...

CVE-2009-3970

The CVE-2009-3970 entry describes a SQL injection in index.php of PHP Dir Submit (also WebsiteSubmitter/Submitter Script). The vulnerability is triggered by the aid parameter in a showarticle action, allowing remote authenticated users to execute arbitrary SQL commands. Affected software is PHP D...

CVE-2009-3970

creationtimestamp| type| source ---|---|--- 2009-08-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/9484...

openSUSE Security Update : pam_mount (pam_mount-191)

pammount allowed users to mount arbitrary devices to any directory when the 'luserconf' configuration directive was set CVE-2008-3970. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Mandriva Linux Security Advisory : pam_mount (MDVSA-2008:208-1)

pammount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount. The updated packages have been patched to fix the issue. Update : The fi...

Mandriva Update for pam_mount MDVSA-2008:208-1 (pam_mount)

Check for the Version of pammount OpenVAS Vulnerability Test Mandriva Update for pammount MDVSA-2008:208-1 pammount Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Mandriva Update for pam_mount MDVSA-2008:208-1 (pam_mount)

Check for the Version of pammount OpenVAS Vulnerability Test Mandriva Update for pammount MDVSA-2008:208-1 pammount Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

openSUSE 10 Security Update : pam_mount (pam_mount-5598)

pammount allowed users to mount arbitrary devices to any directory when the 'luserconf' configuration directive was set CVE-2008-3970. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

SuSE 10 Security Update : pam_mount (ZYPP Patch Number 5602)

pammount allowed users to mount arbitrary devices to any directory when the 'luserconf' configuration directive was set. CVE-2008-3970 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ...

CVE-2008-3970

pammount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount...

CVE-2008-3970

pammount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount...

CVE-2008-3970

CVE-2008-3970 affects pam_mount 0.10–0.45 when the luserconf option is enabled. The vulnerability arises because mounting a user-defined volume does not verify mountpoint and source ownership, allowing local users to bypass access restrictions via a local mount. Connected advisories (Mandriva, SU...

CVE-2007-3970

CVE-2007-3970 concerns ESET NOD32 Antivirus prior to 2.2289. A race condition triggered by a crafted CAB file can cause heap corruption, enabling remote code execution as described in the NVD entry. Affected software: ESET NOD32 Antivirus; vulnerability type: race condition in CAB file handling. ...