pwnzilla.txt

/ SSSSSSS, SSSSSSS' PwnZilla 5 - One sploit fits all. FireFox optimized iSY iS; .sS Exploit for IDN host name heap buffer overrun in .SSSSSSS .sS Mozilla browsers FireFox, Mozilla and Netscape iS; .sS Copyright C 2003-2005 by Berend-Jan Wever. .SS sSSSSSSP Official release:...

Mozilla Browsers 0xAD (HOST:) Remote Heap Buffer Overrun Expl (v2)

Exploit for unknown platform in category remote exploits ===================================================================== Mozilla Browsers 0xAD HOST: Remote Heap Buffer Overrun Exploit v2 ===================================================================== / SSSSSSS, SSSSSSS' PwnZilla 5 - O...

IDN heap overrun using soft-hyphens — Mozilla

Tom Ferris reported a Firefox crash when processing a domain name consisting solely of soft-hyphen characters. This is due to a heap overrun triggered when Internationalized Domain Name IDN processing results in an empty string after removing non-mapping characters such as soft-hyphens. This...

Mozilla Thunderbird < 1.0.7 IDN URL Domain Name Overflow

The remote host is using Mozilla Thunderbird, an email client. The remote version of this software contains various security issues that could allow an attacker to execute arbitrary code on the remote host and to disguise URLs. C Tenable Network Security, Inc. include"compat.inc"; if description...

CVE-2005-2871

Buffer overflow in the International Domain Name IDN support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a hostname with all "soft" hyphens character 0xAD, which is not...

CVE-2005-2871

CVE-2005-2871 describes a heap-based buffer overflow in IDN handling (soft-hyphen 0xAD) during Mozilla Firefox IDN normalization (nsStandardURL::BuildNormalizedSpec). Affects Firefox 1.0.6 and earlier, and Netscape 7.x/8.x. Exploitation could crash the browser or run arbitrary code; remote attack...

Mozilla-based browsers contain a buffer overflow in handling URIs containing a malformed IDN hostname

Overview A vulnerability in the way Mozilla products and derivative programs handle certain malformed URIs could allow a remote attacker to execute arbitrary code on a vulnerable system. Description Mozilla products, including the Mozilla Suite, and Mozilla Firefox are vulnerable to a buffer...

firefox & mozilla -- buffer overflow vulnerability

Tom Ferris reports: A buffer overflow vulnerability exists within Firefox version 1.0.6 and all other prior versions which allows for an attacker to remotely execute arbitrary code on an affected host. The problem seems to be when a hostname which has all dashes causes the NormalizeIDN call in...

CVE-2005-0238

The International Domain Name IDN support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks...

CVE-2005-0236

The International Domain Name IDN support in Omniweb 5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks...

CVE-2005-0234

The International Domain Name IDN support in Safari 1.2.5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks...

CVE-2005-0238

The International Domain Name IDN support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks...

SUSE-SA:2005:022: kdelibs3

The remote host is missing the patch for the advisory SUSE-SA:2005:022 kdelibs3. Several vulnerabilities have been identified and fixed in the KDE desktop environment. - A buffer overflow via specially crafted PCX pictures was fixed. This could lead to a remote attacker being able to execute code...

[Full-disclosure] SUSE Security Announcement: various KDE security problems &#40;SUSE-SA:2005:022&#41;

-----BEGIN PGP SIGNED MESSAGE----- SUSE Security Announcement Package: kdelibs3 Announcement-ID: SUSE-SA:2005:022 Date: Mon, 11 Apr 2005 15:00:00 +0000 Affected products: 9.1, 9.2, 9.3 SUSE Linux Enterprise Server 9 Novell Linux Desktop 9 Vulnerability Type: remote code execution local denial of...

security flaw

The International Domain Name IDN support in Konqueror 3.2.1 on KDE 3.2.1 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing...

Important: Red Hat Security Advisory: kdelibs security update

Updated kdelibs packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdelibs package provides libraries for the K Desktop Environment. The International...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2005:058)

A vulnerability in dcopserver was discovered by Sebastian Krahmer of the SUSE security team. A local user can lock up the dcopserver of other users on the same machine by stalling the DCOP authentication process, causing a local Denial of Service. dcopserver is the KDE Desktop Communication...

Multiple KDE Security Advisories &#40;2005-03-16&#41;

Three KDE security advisories have been issued today. KDE Security Advisory: Local DCOP denial of service vulnerability Original Release Date: 20050316 URL: http://www.kde.org/info/security/advisory-20050316-1.txt 0. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0396 1. System...

Internationalized Domain Name (IDN) homograph spoofing — Mozilla

Internationalized Domain Names IDN allow non-English speakers to use domains in their local language. Because many supported characters are similar to other if not identical in some fonts there is the possibility this could be used to construct perfect, indistinguishable phishing sites...

CVE-2005-0234

The International Domain Name IDN support in Safari 1.2.5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks...