Abee CHM Maker和CHM eBook Creator FileName参数栈溢出漏洞

BUGTRAQ ID: 34279 Abee Chm Maker是用于创建chm文件的程序，Abee Chm eBook Creator是用于创建CHM格式电子书的程序。 Abee CHM Maker和CHM eBook Creator没有正确地处理.chmprj或.cmp项目文件。如果用户受骗打开了定义有超长FileName参数的项目文件的话，就可以触发栈溢出，导致执行任意代码。 AbeeTech Abee CHM Maker 1.9.5 AbeeTech Abee CHM eBook Creator 2.11 AbeeTech --------...

Directory traversal

Directory traversal vulnerability in download.php in Text Lines Rearrange Script 1.0, when registerglobals is enabled, allows remote attackers to read arbitrary local files via directory traversal sequences in the filename parameter...

CVE-2008-6334

Directory traversal vulnerability in download.php in eMetrix Extract Website allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2008-6288

Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

Directory traversal

Directory traversal vulnerability in download.php in Interface Medien ibase 2.03 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2008-3577

Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttdmain function. NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments...

CVE-2008-3577

Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttdmain function. NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments...

Windows GDI EMF filename buffer overflow

Added: 04/09/2008 CVE: CVE-2008-1087 BID: 28570 OSVDB: 44215 Background The Windows Graphics Device Interface GDI interacts with graphics device drivers on behalf of applications. Problem A buffer overflow in Windows GDI allows command execution when a user opens a specially crafted EMF file...

CVE-2008-1125

Multiple directory traversal vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to read arbitrary files via a .. dot dot in the 1 themepath parameter to core/themes.php and the 2 filename parameter to download.php...

Directory traversal

Directory traversal vulnerability in downloadfile.php in PolDoc CMS aka PDDMS 0.96 allows remote attackers to read arbitrary files via a .. dot dot or absolute pathname in the filename parameter...

CVE-2007-6378

Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files via a .. dot dot in the filename parameter...

T1lib intT1_Env_GetCompletePath函数远程缓冲区溢出漏洞

BUGTRAQ ID: 25079 t1lib是一个用C编写的函数库，用于从Adobe Type 1字体生成位图。 t1lib库的实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞通过诱使用户处理畸形文档控制用户系统。 t1lib库的lib/t1lib/t1env.c文件中的intT1EnvGetCompletePath函数中存在缓冲区溢出，如果使用该库的应用程序处理了FileName参数中的超长字符串的话，就可以触发这个溢出，导致执行任意指令。 t1lib 5.1.1 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

CVE-2007-4033

Buffer overflow in the intT1EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in phpgd2.dll in the gd PHPGD2...

Buffer overflow

Buffer overflow in the intT1EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in phpgd2.dll in the gd PHPGD2...

CVE-2007-4033

Buffer overflow in the intT1EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in phpgd2.dll in the gd PHPGD2...

Stack overflow

Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control IMW32O40.OCX 4.00.041 allow remote attackers to execute arbitrary code via 1 a long FileName parameter, or unspecified vectors involving the 2 BeginReport, 3 CreatePictureExA, 4 DefineImage, 5 DefineImageEx, 6...

CVE-2007-2190

PHP remote file inclusion vulnerability in admin/public/webpages.php in Eba News 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter...

PT-2007-3531 · Eba News · Eba News

Name of the Vulnerable Software and Affected Versions: Eba News version 1.1 Description: A remote file inclusion issue in the admin/public/webpages.php file allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter. Recommendations: For Eba News version 1.1, avoid...

PT-2007-3204 · 2Bgal · 2Bgal

Name of the Vulnerable Software and Affected Versions: 2BGal version 3.1.1 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the lang filename parameter to 1 "index.php" or 2 "backupdb.inc.php" in admin/, or other unspecified files. Recommendations: For 2BG...

PT-2007-1411 · Php · Upload Tool For Php

Name of the Vulnerable Software and Affected Versions: Upload Tool for PHP version 1.0 Description: The issue allows remote attackers to read arbitrary files via directory traversal attacks using ".." sequences or absolute pathnames in the filename parameter of the /upload/bin/download.php API...