[SECURITY] [DSA 141-1] New mpack packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 141-1 [email protected] http://www.debian.org/security/ Martin Schulze August 1st, 2002 - -------------------------------------------------------------------------- Package : mpack...

DSA-141 mpack - buffer overflow

Bulletin has no description...

ASN.1 parsing errors exist in implementations of SSL, TLS, S/MIME, PKCS#7 routines

Overview Abstract Syntax Notation number One ASN.1 is an international standard used to describe and transmit data packets between applications and across networks. There is a vulnerability related to ASN.1 that could permit an attacker to cause a denial of service or potentially execute arbitrar...

Medium security hole affecting W3Mail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I believe I've found a medium level security hole relating to the way W3Mail stores MIME attachments. I contacted the authors CascadeSoft - http://www.cascadesoft.com/ on the 19th, offering them 14 days to produce a fix, but have had no reply to...

Sendmail < 8.8.5 MIME Conversion Malformed Header Overflow

The remote Sendmail server, according to its version number, may be vulnerable to a MIME conversion overflow attack which allows anyone to execute arbitrary commands as root. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10055; scriptversion"1.22";...

Denial of Service bug in Pine 4.44

Hi, while using pine I found a small bug which causes pine to crash. When opening a MIME encoded mail with a blank boundary, pine will crash. The header looks like this: ... Content-Type: multipart/mixed; boundary="" Mime-Version: 1.0 ... This is no dangerous bug and you can simply delete the...

Pine 4.x - Empty MIME Boundary Denial of Service

Pine 4.x - Empty MIME Boundary Denial of Service source: https://www.securityfocus.com/bid/5301/info Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems. When a mail is received by pine that...

Pine 4.x - Empty MIME Boundary Denial of Service

source: https://www.securityfocus.com/bid/5301/info Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems. When a mail is received by pine that contains MIME content, and the value of the MIME...

Microsoft Outlook Express 5/6 - Spoofable File Extensions

source: https://www.securityfocus.com/bid/5277/info It is possible for a malicious user, sending email via a mail agent capable of manipulating the MIME headers, to spoof file extensions for users of Outlook Express. For example, an .exe file can be made to look like a .txt or other seemingly...

MIME::Tools Perl module and virus scanners

Background ---------- MIME::Tools is a very nice Perl module for parsing and constructing MIME-encoded mail messages. The latest stable version is 5.411a. MIME::Tools works very well on valid MIME messages. However, there are a number of problems if you use it to implement server-based mail...

CVE-2002-0252

Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header...

CVE-2002-0269

Summary: CVE-2002-0269 concerns Internet Explorer 5.x/6 that treats a loaded object as an HTML document even when its MIME type is text/plain, potentially enabling remote script execution in documents the user trusts not to contain executable content. What is affected: Internet Explorer 5.x and 6...

CVE-2002-0270

CVE-2002-0270 involves Opera. When the option “Determine action by MIME type” is disabled, Opera may treat an object as an HTML document even if its Content-Type is text/plain. This can allow remote attackers to execute arbitrary scripts in documents users do not expect, potentially affecting web...

CVE-2002-0270

Opera, when configured with the "Determine action by MIME type" option disabled, interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web...

CVE-2002-0269

Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent...

DoS and forced user addition to ICQ

ICQ register appllication/x-icq MIME type .uin for files. This files allows to add user to contact list without notice. It's also possible to cause DoS against ICQ via .hpf files...

Bypassing content filtering

There are common methods allowing to bypass almost any content filtering software antiviral products, CVP firewalls, mail attachment filters, etc. I believe multiple products are vulnerable. Contents: I. Bypassing attachment detection or invalid detection of attachment type. 1. Encoded filename o...

CVE-2001-0700

Buffer overflow in w3m 0.2.1 and earlier allows a remote attacker to execute arbitrary code via a long base64 encoded MIME header...

CVE-2001-0544

IIS 5.0 allows local users to cause a denial of service hang via by installing content that produces a certain invalid MIME Content-Type header, which corrupts the File Type table...

CVE-2001-0692

The vulnerability CVE-2001-0692 affects WatchGuard Firebox SMTP proxy in models 2500 and 4500 running versions 4.5 and 4.6. A remote attacker can bypass firewall filtering by sending a base64 MIME email attachment whose boundary name ends with two dashes, exploiting how the SMTP proxy processes M...