Apache 2.0 - Full Path Disclosure

source: https://www.securityfocus.com/bid/5485/info A path disclosure vulnerability has been reported in Apache 2.0.x. It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files such as error documents that have been mapped by the server by typ...

Buffer overflow in Eudora

Buffer overflow on MIME headers parsing...

Qualcomm Eudora 5 - MIME MultiPart Boundary Buffer Overflow

Qualcomm Eudora 5 - MIME MultiPart Boundary Buffer Overflow source: https://www.securityfocus.com/bid/5397/info A buffer overflow vulnerability has been reported in Qualcomm's Eudora mail client for Windows systems. The condition occurs if a MIME multipart boundary is of excessive length. Remote...

[SECURITY] [DSA 141-1] New mpack packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 141-1 [email protected] http://www.debian.org/security/ Martin Schulze August 1st, 2002 - -------------------------------------------------------------------------- Package : mpack...

DSA-141 mpack - buffer overflow

Bulletin has no description...

ASN.1 parsing errors exist in implementations of SSL, TLS, S/MIME, PKCS#7 routines

Overview Abstract Syntax Notation number One ASN.1 is an international standard used to describe and transmit data packets between applications and across networks. There is a vulnerability related to ASN.1 that could permit an attacker to cause a denial of service or potentially execute arbitrar...

Medium security hole affecting W3Mail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I believe I've found a medium level security hole relating to the way W3Mail stores MIME attachments. I contacted the authors CascadeSoft - http://www.cascadesoft.com/ on the 19th, offering them 14 days to produce a fix, but have had no reply to...

Sendmail < 8.8.5 MIME Conversion Malformed Header Overflow

The remote Sendmail server, according to its version number, may be vulnerable to a MIME conversion overflow attack which allows anyone to execute arbitrary commands as root. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10055; scriptversion"1.22";...

Denial of Service bug in Pine 4.44

Hi, while using pine I found a small bug which causes pine to crash. When opening a MIME encoded mail with a blank boundary, pine will crash. The header looks like this: ... Content-Type: multipart/mixed; boundary="" Mime-Version: 1.0 ... This is no dangerous bug and you can simply delete the...

Pine 4.x - Empty MIME Boundary Denial of Service

Pine 4.x - Empty MIME Boundary Denial of Service source: https://www.securityfocus.com/bid/5301/info Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems. When a mail is received by pine that...

Pine 4.x - Empty MIME Boundary Denial of Service

source: https://www.securityfocus.com/bid/5301/info Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems. When a mail is received by pine that contains MIME content, and the value of the MIME...

Microsoft Outlook Express 5/6 - Spoofable File Extensions

source: https://www.securityfocus.com/bid/5277/info It is possible for a malicious user, sending email via a mail agent capable of manipulating the MIME headers, to spoof file extensions for users of Outlook Express. For example, an .exe file can be made to look like a .txt or other seemingly...

MIME::Tools Perl module and virus scanners

Background ---------- MIME::Tools is a very nice Perl module for parsing and constructing MIME-encoded mail messages. The latest stable version is 5.411a. MIME::Tools works very well on valid MIME messages. However, there are a number of problems if you use it to implement server-based mail...

CVE-2002-0252

Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header...

CVE-2002-0270

CVE-2002-0270 involves Opera. When the option “Determine action by MIME type” is disabled, Opera may treat an object as an HTML document even if its Content-Type is text/plain. This can allow remote attackers to execute arbitrary scripts in documents users do not expect, potentially affecting web...

CVE-2002-0269

Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web applications that use a text/plain type to prevent...

CVE-2002-0270

Opera, when configured with the "Determine action by MIME type" option disabled, interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web...

CVE-2002-0269

Summary: CVE-2002-0269 concerns Internet Explorer 5.x/6 that treats a loaded object as an HTML document even when its MIME type is text/plain, potentially enabling remote script execution in documents the user trusts not to contain executable content. What is affected: Internet Explorer 5.x and 6...

CVE-2002-0270: Improper Neutralization of Input During Web Page Generation

Opera, when configured with the "Determine action by MIME type" option disabled, interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web...

CVE-2002-0252: Undefined Security Weakness

Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header...