5153 matches found
CVE-2001-0677
Eudora 5.0.2 is affected. A remote attacker can read arbitrary files by crafting an email whose Attachment Converted MIME header contains the path to a target file; when the user forwards the message, the file is sent to the attacker. Root cause involves improper handling of the Attachment Conver...
CVE-2001-0692
SMTP proxy in WatchGuard Firebox 2500 and 4500 4.5 and 4.6 allows a remote attacker to bypass firewall filtering via a base64 MIME encoded email attachment whose boundary name ends in two dashes...
CVE-2001-0544
CVE-2001-0544 affects IIS 5.0. A crafted invalid MIME Content-Type header can cause a denial of service by corrupting the File Type table. Local user access, no authentication required, partial availability impact. Connected docs mention related MS01-044 references; no patch/fix details are provi...
CVE-2001-0700
CVE-2001-0700 affects w3m up to version 0.2.1, where a buffer overflow in MIME header parsing may allow a remote attacker to execute arbitrary code via a long base64-encoded MIME header. Debian advisories DSA-064-1 and DSA-081-1 address this by updating w3m and w3m-ssl; OpenVAS/NASL entries descr...
Critical: Red Hat Security Advisory: : Updated PHP packages are available [updated 2002-Mar-11]
Updated PHP packages are available to fix vulnerabilities in the functions that parse multipart MIME data, which are used when uploading files through forms. This revised advisory contains updated packages for Red Hat Linux 7, 7.1, and 7.2. PHP is an HTML-embeddable scripting language. A number o...
CVE-2001-0999
CVE-2001-0999 concerns Outlook Express 6.00, where remote attackers could cause arbitrary script execution by embedding SCRIPT tags in a message with MIME type text/plain. This contradicts the expected behavior that text/plain messages do not run scripts. The available references (NVD, CVE List) ...
CVE-2001-0999
Outlook Express 6.00 allows remote attackers to execute arbitrary script by embedding SCRIPT tags in a message whose MIME content type is text/plain, contrary to the expected behavior that text/plain messages will not run script...
MSIE may download and run programs automatically - details
This posting briefly describes some technical details of the vulnerability discussed in the Bugtraq messages with the subjects "MSIE may download and run progams automatically" Dec 14 2001 and "File extensions spoofable in MSIE download dialog" Nov 26 2001. The flaw allows a malicious web site to...
Advisory CA-2001-36 Microsoft Internet Explorer Does Not Respect Content-Disposition and Content-Type MIME Headers
CERT Advisory CA-2001-36 Microsoft Internet Explorer Does Not Respect Content-Disposition and Content-Type MIME Headers Original release date: December 19, 2001 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Microsoft Internet...
Microsoft Internet Explorer Does Not Respect Content-Disposition and Content-Type MIME Headers
Overview Microsoft Internet Explorer contains a vulnerability in its handling of certain MIME headers in web pages and HTML email messages. This vulnerability may allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message...
CVE-2001-0544
IIS 5.0 allows local users to cause a denial of service hang via by installing content that produces a certain invalid MIME Content-Type header, which corrupts the File Type table...
CVE-2001-0712
The rendering engine in Internet Explorer determines the MIME type independently of the type that is specified by the server, which allows remote servers to automatically execute script which is placed in a file whose MIME type does not normally support scripting, such as text .txt, JPEG .jpg, et...
[SECURITY] [DSA 081-1] New w3m packages fix buffer overflow
-------------------------------------------------------------------------- Debian Security Advisory DSA 081-1 [email protected] http://www.debian.org/security/ Martin Schulze October 18th, 2001 - -------------------------------------------------------------------------- Packages : w3m, w3m-ssl...
CVE-2001-0712
The rendering engine in Internet Explorer determines the MIME type independently of the type that is specified by the server, which allows remote servers to automatically execute script which is placed in a file whose MIME type does not normally support scripting, such as text .txt, JPEG .jpg, et...
CVE-2001-0712
The CVE concerns Internet Explorer’s rendering engine where MIME types are determined by the client rather than the server. This enables remote servers to coax script execution from files whose MIME type would not normally be treated as executable (e.g., .txt, .jpg). Reported impact scores indica...
CVE-2001-0700
Buffer overflow in w3m 0.2.1 and earlier allows a remote attacker to execute arbitrary code via a long base64 encoded MIME header...
CVE-2001-0677
Eudora 5.0.2 allows a remote attacker to read arbitrary files via an email with the path of the target file in the "Attachment Converted" MIME header, which sends the file when the email is forwarded to the attacker by the user...
Buffer Overflows in various email clients
Overview Buffer Overflows in several MIME headers affect a large number of electronic mail clients. Description A variety of electronic mail clients circa 1998 are vulnerable to buffer overflow attacks in the code that processes MIME headers. See the vendor statements referenced below for details...