PHP tempname()函数绕过safe_mode安全限制漏洞

BUGTRAQ ID: 36555 CVE ID: CVE-2009-3557 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的tempnam中的错误可能允许绕过safemode限制。以下是ext/standard/file.c中的有漏洞代码段： PHPFUNCTIONtempnam char dir, prefix; int dirlen, prefixlen; sizet plen; char openedpath; char p; int fd; if zendparseparametersZENDNUMARGS TSRMLSCC, "ss"...

Hung it to the two new methods 1 1 hackers Handbook manuscript-a vulnerability warning-the black bar safety net

Hung it to the two new methods lcx Here only to do a technical discussion, not a specific hazard of the things. If you want to use my method to do it, I can't help it, huh. On the hanging horse is basically in a web page the original code of Riga contained an iframe. On loading the iframe, I used...

[SECURITY] Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-6.fc10.6

This module allows you to use the Mozilla embedding widget from Perl...

[SECURITY] Fedora 11 Update: perl-Gtk2-MozEmbed-0.08-6.fc11.6

This module allows you to use the Mozilla embedding widget from Perl...

[SECURITY] Fedora 11 Update: hulahop-0.4.9-8.fc11

The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...

[SECURITY] Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-6.fc10.5

This module allows you to use the Mozilla embedding widget from Perl...

Fedora Core 10 FEDORA-2009-8288 (perl-Gtk2-MozEmbed)

The remote host is missing an update to perl-Gtk2-MozEmbed announced via advisory FEDORA-2009-8288. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are...

embedded zero in cert name

SSL and TLS Server certificates contain one or more fields with server name or otherwise matching patterns. These strings are stored as content and length within the certificate, and thus there is no particular terminating character. curl's OpenSSL interfacing code did faulty assumptions about...

[SECURITY] Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-6.fc10.4

This module allows you to use the Mozilla embedding widget from Perl...

[SECURITY] Fedora 11 Update: hulahop-0.4.9-7.fc11

The hulalop library contains a widget for embedding mozilla. It's based on pyxpcom and give access to the whole mozilla xpcom API through python...

[SECURITY] Fedora 11 Update: perl-Gtk2-MozEmbed-0.08-6.fc11.4

This module allows you to use the Mozilla embedding widget from Perl...

CVE-2009-2493

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly...

[SECURITY] Fedora 11 Update: perl-Gtk2-MozEmbed-0.08-6.fc11.3

This module allows you to use the Mozilla embedding widget from Perl...

[SECURITY] Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-6.fc10.2

This module allows you to use the Mozilla embedding widget from Perl...

[SECURITY] Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-5.fc10.2

This module allows you to use the Mozilla embedding widget from Perl...

[SECURITY] Fedora 10 Update: gecko-sharp2-0.13-3.fc10

This package provides Mono bindings for the Gecko engine, through an easy-to-use widget that will allow you to embed a Mozilla browser window into your Gtk application...

PT-2008-5544 · Microsoft · Internet Explorer +2

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 5.01 SP4, 6 SP1 Microsoft Internet Explorer version 6 on Windows XP and Server 2003 Description: The issue arises from a stack-based buffer overflow that occurs when Microsoft Internet Explorer does not...

CVE-2008-2806

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin JEP and Java LiveConnect...

CVE-2008-2806

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin JEP and Java LiveConnect...

Design/Logic Flaw

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin JEP and Java LiveConnect...