[scip_Advisory 4021] IBM Lotus Notes 8.5 RSS Widget Privilege Escalation

IBM Lotus Notes 8.5 RSS Widget Privilege Escalation scip AG Vulnerability ID 4021 09/08/2009 http://www.scip.ch/?vuldb.4021 I. INTRODUCTION Lotus Notes is a client-server, collaborative application developed and sold by IBM Software Group. More information is available on the official product web...

IBM Lotus Notes 8.5 RSS Widget crossite scripting

Scripting in local host zone is possible...

CVE-2009-3114: Improper Control of Generation of Code

The RSS reader widget in IBM Lotus Notes 8.0 and 8.5 saves items from an RSS feed as local HTML documents, which allows remote attackers to execute arbitrary script in Internet Explorer's Local Machine Zone via a crafted feed, aka SPR RGAU7RDJ9K...

Buffer overflow

Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer aka File Viewer for Excel, as used in IBM Lotus Notes 5.x through 8.5.x, Symantec Mail Security, Symantec BrightMail Appliance, Symantec Data Loss Prevention DLP, and other products, allows remote attackers to execute arbitrary code...

CVE-2009-3037

CVE-2009-3037 is a buffer overflow in the Autonomy KeyView XLS viewer (xlssr.dll) used by IBM Lotus Notes and multiple Symantec products (Mail Security, BrightMail, DLP, etc.). The overflow occurs while parsing Excel .xls attachments, enabling remote code execution by enticing a user to open a ma...

Autonomy KeyView Module Excel Document Processing Buffer Overflow Vulnerability

Description Autonomy KeyView module is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers. Exploiting this issue will allow an attacker to corrupt memory and cause denial-of-service...

Autonomy KeyView模块Word Perfect文件解析栈溢出漏洞

BUGTRAQ ID: 34086 CVECAN ID: CVE-2008-4564 KeyView是用于导出、转换和查看各种格式文件的软件包。 KeyView模块的wp6sr.dll库在处理Word Perfect文档时未经边界检查便将某些记录和数据拷贝到了固定大小的栈缓冲区中，如果用户受骗打开了恶意文档的话就可以触发栈溢出，导致执行任意代码。 IBM Lotus Notes 8.0 IBM Lotus Notes 7.0 IBM Lotus Notes 6.5 Symantec Mail Security 7.5.x Symantec Mail Security 6.0.x...

Autonomy KeyView SDK buffer overflow vulnerability

Overview Autonomy KeyView SDK contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code. Description Autonomy KeyView SDK is a commercial software development kit SDK that includes file filtering libraries. A vulnerability exists in the way the SDK libraries...

Stack overflow

Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier, as used in IBM Lotus Notes, Symantec Mail Security SMS products, Symantec BrightMail Appliance products, and Symantec Data Loss Prevention DLP products, allows remote attackers to execute arbitrary code via a...

CVE-2008-4564

Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier, as used in IBM Lotus Notes, Symantec Mail Security SMS products, Symantec BrightMail Appliance products, and Symantec Data Loss Prevention DLP products, allows remote attackers to execute arbitrary code via a...

CVE-2008-4564

A stack-based buffer overflow in Autonomy KeyView SDK wp6sr.dll (WordPerfect document parser) allows remote code execution. The CVE-2008-4564 issue affects IBM Lotus Notes (and other products using KeyView), caused by unbounded copying of records into a fixed-size stack buffer when processing WPD...

applemail-dos.txt

Summary A maliciously crafted e-mail message can cause a denial of service in multiple versions of the Apple Mail email client. Scope Apple Mail version 3.1 914/915 Apple Mail version 3.2 919/919.2 Note: other versions of this product may be vulnerable as well; I have not tested them. The vendor...

IBM Lotus Notes / Autonomy Keyview multiple security vulnerabilities

Multiple buffer overflows...

Code injection

kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy formerly Verity KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, does not properly parse long tokens, which allows remote attackers to cause a denial of service CPU and memory...

Buffer overflow

Multiple buffer overflows in htmsr.dll in the HTML speed reader in Autonomy formerly Verity KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allow remote attackers to execute arbitrary code via an HTML document with 1 "large chunks of data," or a long URL in the 2 BACKGROUND attribute of a BO...

Buffer overflow

Buffer overflow in mimesr.dll in Autonomy formerly Verity KeyView, as used in IBM Lotus Notes before 8.0, might allow user-assisted remote attackers to execute arbitrary code via an e-mail message with a crafted Text mail MIME attachment...

Buffer overflow

Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy formerly Verity KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, allow remote attackers to execute arbitrary code via a .ag file with 1 a long ENCODING...

CVE-2008-1718

Buffer overflow in mimesr.dll in Autonomy formerly Verity KeyView, as used in IBM Lotus Notes before 8.0, might allow user-assisted remote attackers to execute arbitrary code via an e-mail message with a crafted Text mail MIME attachment...

CVE-2008-0066

Multiple buffer overflows in htmsr.dll in the HTML speed reader in Autonomy formerly Verity KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allow remote attackers to execute arbitrary code via an HTML document with 1 "large chunks of data," or a long URL in the 2 BACKGROUND attribute of a BO...

CVE-2008-1101

Buffer overflow in kvdocve.dll in the KeyView document viewing engine in Autonomy formerly Verity KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allows remote attackers to execute arbitrary code via a long pathname, as demonstrated by a long SRC attribute of an IMG element in an HTML docume...