kernel ieee80211 off-by-two integer underflow

Integer underflow in the ieee80211rx function in net/ieee80211/ieee80211rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service crash via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211STYPEQOSDATA flag is set, aka an "off-by-two...

Unfixed Frame Redirect vulnerability at www.regalcinemas.com

Security researcher MrSlinky, has submitted on 26/11/2007 a Frame Redirect vulnerability affecting www.regalcinemas.com, which at the time of submission ranked 52561 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 29/11/2007. It is currently...

tcpdump denial of service

Off-by-one buffer overflow in the parseelements function in the 802.11 printer code print-80211.c for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service crash via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based...

Cross site scripting

Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to conduct cross-site scripting XSS attacks by causing JavaScript events to be associated with the wrong frame...

CVE-2007-4698

Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to conduct cross-site scripting XSS attacks by causing JavaScript events to be associated with the wrong frame...

tcpdump denial of service

Off-by-one buffer overflow in the parseelements function in the 802.11 printer code print-80211.c for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service crash via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based...

CVE-2007-4997: Undefined Security Weakness

Integer underflow in the ieee80211rx function in net/ieee80211/ieee80211rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service crash via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211STYPEQOSDATA flag is set, aka an "off-by-two...

openSUSE 10 Security Update : seamonkey (seamonkey-2098)

This security update brings Mozilla SeaMonkey to version 1.0.5. Please also see http://www.mozilla.org/projects/security/known-vulnerabilities.html for more details. It includes fixes to the following security problems: MFSA 2006-64/CVE-2006-4571: Crashes with evidence of memory corruption MFSA...

openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-3933)

This update brings Mozilla Firefox to security update version 2.0.0.5 Following security problems were fixed : - MFSA 2007-18: Crashes with evidence of memory corruption The usual collection of stability fixes for crashes that look suspicious but haven't been proven to be exploitable. 25 were in...

openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-3935)

This update brings Mozilla Firefox to security update version 2.0.0.5 Following security problems were fixed : - MFSA 2007-18: Crashes with evidence of memory corruption The usual collection of stability fixes for crashes that look suspicious but haven't been proven to be exploitable. 25 were in...

openSUSE 10 Security Update : seamonkey (seamonkey-3984)

This update fixes several security issues in Mozilla SeaMonkey 1.1.3. Following security problems were fixed : - MFSA 2007-18: Crashes with evidence of memory corruption The usual collection of stability fixes for crashes that look suspicious but haven't been proven to be exploitable. 25 were in...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-3973)

This update fixes several security problems in Mozilla Thunderbird 1.5.0.12. Following security problems were fixed : - MFSA 2007-18: Crashes with evidence of memory corruption The usual collection of stability fixes for crashes that look suspicious but haven't been proven to be exploitable. 25...

openSUSE 10 Security Update : seamonkey (seamonkey-3986)

This update fixes several security issues in Mozilla SeaMonkey 1.0.9. Following security problems were fixed : - MFSA 2007-18: Crashes with evidence of memory corruption The usual collection of stability fixes for crashes that look suspicious but haven't been proven to be exploitable. 25 were in...

Scripts can overwrite functions on pages from other domains – Opera Security Advisories

Scripts can overwrite functions on pages from other domains – Opera Security Advisories OPCOM Team | October 16, 2007 Scripts can overwrite functions on pages from other domains. Severity: Highly Severe Affected Versions All versions of Opera for Desktop prior to Opera 9.24. Problem Description...

Linux Madwifi wireless drivers DoS

Assert on oversized "extended supported rates" beacon frame...

SEC Consult SA-20071012-0 :: Madwifi xrates element remote DOS

SEC Consult Security Advisory 20071012-0 =================================================================================== title: Madwifi xrates element remote DOS program: Madwifi linux wlan driver for atheros chipsets vulnerable version: Madwifi = 0.9.3.2 homepage: www.madwifi.org found: July...

Code injection

Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service panic via a beacon frame with a large length value in the extended supported rates xrates element, which triggers an assertion error, related to net80211/ieee80211scanap.c and net80211/ieee80211scansta.c...

CVE-2007-5448

Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service panic via a beacon frame with a large length value in the extended supported rates xrates element, which triggers an assertion error, related to net80211/ieee80211scanap.c and net80211/ieee80211scansta.c...

CVE-2007-5448

Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service panic via a beacon frame with a large length value in the extended supported rates xrates element, which triggers an assertion error, related to net80211/ieee80211scanap.c and net80211/ieee80211scansta.c...

CVE-2007-5448

CVE-2007-5448 affects MadWifi 0.9.3.2 and earlier. A remote attacker can trigger a denial of service (kernel panic) by sending a beacon frame with a large length value in the extended supported rates (xrates) element, exploiting code in net80211/ieee80211_scan_ap.c and net80211/ieee80211_scan_sta...