CVE-2010-1192

CVE-2010-1192 affects libESMTP (likely 1.0.4 and earlier). The issue is improper handling of a NULL ('\0') character in the domain name within the Common Name field of an X.509 certificate, enabling MITM attackers to spoof SSL servers via a certificate issued by a legitimate CA. The description n...

DNS Domain Name Resolution Detection

Binary data 7026.pasl...

squid: temporary DoS (assertion failure) triggered by truncated DNS packet (SQUID-2010:1)

lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service assertion failure via a crafted DNS packet that only contains a header...

Mozilla data corruption with SOCKS5 reply

Mozilla Firefox before 3.0.12, and 3.5.x before 3.5.2, allows remote SOCKS5 proxy servers to cause a denial of service data stream corruption via a long domain name in a reply...

getPlus ActiveX code execution

Insufficient validation of domain name...

CVE-2003-1583

Cross-site scripting XSS vulnerability in WebTrends allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption ILLC" issue...

DEBIAN-CVE-2003-1581

The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log...

CVE-2003-1584

Cross-site scripting XSS vulnerability in SurfStats allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption ILLC" issue...

CVE-2003-1578

Sun ONE aka iPlanet Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning...

CVE-2003-1583

Cross-site scripting XSS vulnerability in WebTrends allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption ILLC" issue...

CVE-2003-1585

Cross-site scripting XSS vulnerability in WebLogExpert allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption ILLC" issue...

DEBIAN-CVE-2010-0308

lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service assertion failure via a crafted DNS packet that only contains a header...

DEBIAN-CVE-2010-0464

Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests...

DEBIAN-CVE-2010-0382

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response...

DEBIAN-CVE-2010-0290

Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta, with DNSSEC validation enabled and checking disabled CD, allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query a...

[SECURITY] Fedora 11 Update: bind-9.6.1-9.P3.fc11

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

BIND DNSSEC NSEC/NSEC3 validation code could cause bogus NXDOMAIN responses

ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC 1 NSEC and 2 NSEC3 records, which allows remote attackers to add the Authenticated Data AD flag to a forged NXDOMAIN response for an existing domain...

FreeBSD Security Advisory (FreeBSD-SA-10:01.bind.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:01.bind.asc ADV FreeBSD-SA-10:01.bind.asc OpenVAS Vulnerability Test $ Description: Auto generated from ADV FreeBSD-SA-10:01.bind.asc Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft...

DEBIAN-CVE-2009-4010

Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones...

Design/Logic Flaw

Visual truncation vulnerability in the MakeScriptDialogTitle function in nsGlobalWindow.cpp in Mozilla Firefox allows remote attackers to spoof the origin domain name of a script via a long name...