CVE-2009-0398

Array index error in the gstqtptrakhandler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins aka gstreamer-plugins 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file...

CVE-2009-0398

CVE-2009-0398 affects GStreamer-plugins: an array indexing error in the QuickTime decoding plug-in (gst_qtp_trak_handler in qtdemux.c) on GStreamer 0.6.0. This security flaw could allow a remote attacker to cause a crash or potentially execute arbitrary code by supplying a crafted QuickTime media...

CVE-2009-0387

Array index error in the qtdemuxparsesamples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins aka gst-plugins-good 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via crafted Sync Sample aka stss atom da...

CVE-2009-0136

Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service application crash or execute arbitrary code via an Audible Audio .aa file with a crafted 1 nlen or 2 vlen Tag...

CVE-2009-0136

Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service application crash or execute arbitrary code via an Audible Audio .aa file with a crafted 1 nlen or 2 vlen Tag...

CVE-2009-0136

Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service application crash or execute arbitrary code via an Audible Audio .aa file with a crafted 1 nlen or 2 vlen Tag...

CVE-2009-0136

The CVE-2009-0136 issue affects Amarok 1.4.10–2.0.1 through an insecure parsing path in Audible Audio (.aa) files. Specifically, multiple array index errors in Audible::Tag::readTag (metadata/audible/audibletag.cpp) can lead to an invalid pointer dereference or writing a 0x00 byte, after an alloc...

DEBIAN-CVE-2008-5903

Array index error in the xrdpbitmapdefproc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the editpos structure member...

CVE-2008-5903

Array index error in the xrdpbitmapdefproc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the editpos structure member...

CVE-2008-5903

Array index error in the xrdpbitmapdefproc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the editpos structure member...

CVE-2008-5903

Array index error in the xrdpbitmapdefproc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the editpos structure member...

CVE-2008-5903

The CVE-2008-5903 entry applies to xrdp, specifically versions up to 0.4.1, where an array index error in xrdp_bitmap_def_proc (xrdp/funcs.c) can allow a remote attacker to execute arbitrary code by manipulating the edit_pos member. The connected SUSE update notes that a patch (xrdp-458) fixes mu...

CVE-2008-5903

Array index error in the xrdpbitmapdefproc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the editpos structure member...

Debian DSA-1699-1 : zaptel - array index error

An array index error in zaptel, a set of drivers for telephony hardware, could allow users to crash the system or escalate their privileges by overwriting kernel memory CVE-2008-5396 . %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

zaptel多个驱动数组索引漏洞

BUGTRAQ ID: 32575 CVECAN ID: CVE-2008-5396,CVE-2008-5744 zaptel软件包是用于配置Zapata电话内核驱动的用户工具。 由于对ZTSPANCONFIG ioctl相关的sync字段缺少检查，导致Zaptel中的torisa.c驱动的torisaspanconfig函数和dahdi/tor2.c驱动的tor2spanconfig函数存在数组索引错误。dialout组中的本地用户可以通过写入/dev/zap/ctl覆盖内核内存中的整数值，导致拒绝服务或获得权限提升。 Diginum Zaptel 1.4.x Diginum Zapt...

Design/Logic Flaw

Array index error in the dahdi/tor2.c driver in Zaptel aka DAHDI 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check...

CVE-2008-5744

Array index error in the dahdi/tor2.c driver in Zaptel aka DAHDI 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check...

CVE-2008-5744

Array index error in the dahdi/tor2.c driver in Zaptel aka DAHDI 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check...

CVE-2008-5744

Array index error in the dahdi/tor2.c driver in Zaptel aka DAHDI 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check...

CVE-2008-5744

CVE-2008-5744 describes an array index error in the zaptel/DAHDI driver (dahdi/tor2.c) that allows local users in the dialout group to overwrite kernel memory by writing to /dev/zap/ctl. Affected: Zaptel/DAHDI versions up to 1.4.11 (and related patches). The root cause relates to an incorrect tor...