Use-after-free error using Web Workers — Mozilla

Daniel Kozlowski reported that a JavaScript Worker could be used to keep a reference to an object that could be freed during garbage collection. Subsequent calls through this deleted reference could cause attacker-controlled memory to be executed on a victim's computer...

CVE-2011-1044

CVE-2011-1044 affects the Linux kernel (pre-2.6.37) and is caused by ib_uverbs_poll_cq in drivers/infiniband/core/uverbs_cmd.c not initializing a certain response buffer. This allows local attackers to read potentially sensitive data from kernel memory via vectors that fill the buffer only partia...

CVE-2011-1044

The ibuverbspollcq function in drivers/infiniband/core/uverbscmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially fille...

CVE-2011-0027

CVE-2011-0027 concerns Microsoft Data Access Components (MDAC) 2.8 SP1/SP2 and Windows Data Access Components (WDAC) 6.0, where memory allocation for internal data structures is not properly validated. According to MS11-002, a remote attacker could trigger a code execution by a user viewing a cra...

Novell Groupwise Internet Agent - IMAP 'LIST' Remote Code Execution

Application: PRL Novell Groupwise Internet Agent IMAP LIST Command Remote Code Execution Vulnerability Platforms: Linux Exploitation: Remote code execution CVE Number: Pending Novell TID: 7007151 ZeroDayInitiative: ZDI-10-242 Author: Francis Provencher Protek Research Lab's Blog:...

Microsoft Internet Explorer Uninitialized Memory CVE-2010-3331 Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions. Technologies Affected Avaya Aura...

CVE-2010-2942

The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors relate...

Design/Logic Flaw

The cfg80211wextgiwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctlstandardiwpoint function in net/wireless/wext-core.c, an...

Mozilla Foundation Security Advisory 2010-29

Mozilla Foundation Security Advisory 2010-29 Title: Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal Impact: Critical Announced: June 22, 2010 Reporter: Nils MWR InfoSecurity Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.6.4 Firefox 3.5.10 Thunderbird 3.0.5 SeaMonkey...

Microsoft Windows SMB客户端消息大小解析远程代码执行漏洞（MS10-020）

BUGTRAQ ID: 39340 CVE ID: CVE-2010-0477 Microsoft Windows是微软发布的非常流行的操作系统。 在解析特制的SMB响应时，Microsoft SMB客户端实现中处理响应消息大小的方式中存在内存破坏漏洞。未经认证攻击者可以通过向客户端发起的SMB请求返回特制的SMB响应来利用该漏洞。成功利用此漏洞的攻击者可执行任意代码，并可完全控制受影响的系统。 Microsoft Windows Server 2008 R2 Microsoft Windows 7 临时解决方法： 在防火墙阻断TCP 139和445端口。 厂商补丁： Microsoft...

Mozilla Foundation Security Advisory 2010-17

Mozilla Foundation Security Advisory 2010-17 Title: Remote code execution with use-after-free in nsTreeSelection Impact: Critical Announced: March 30, 2010 Reporter: regenrecht via TippingPoint's Zero Day Initiative Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 3.5.9 Firefox 3.0.19...

Mandriva Update for mozilla-thunderbird MDVSA-2010:051 (mozilla-thunderbird)

Check for the Version of mozilla-thunderbird OpenVAS Vulnerability Test Mandriva Update for mozilla-thunderbird MDVSA-2010:051 mozilla-thunderbird Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2010:051)

A vulnerability has been found and corrected in mozilla-thunderbird : Security researcher Alin Rad Pop of Secunia Research reported that the HTML parser incorrectly freed used memory when insufficient space was available to process remaining input. Under such circumstances, memory occupied by...

Linux Kernel 2.6.18 - 'move_pages()' Information Leak

/ sieve because the Linux kernel leaks like one, get it? Bug NOT discovered by Marcus Meissner of SuSE security This bug was discovered by Ramon de Carvalho Valle in September of 2009 The bug was found via fuzzing, and on Sept 24th I was sent a POC DoS for the bug but had forgotten about it until...

IBM Db2 Client Interfaces component Unspecified Vulnerabilities - Linux

IBM Db2 is prone to unspecified vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ibm:db2"; ifdescription...

CVE-2009-0102

Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a malformed file, aka "Project Memory Validation Vulnerability."...

CVE-2009-3290

CVE-2009-3290 affects KVM in Linux kernel 2.6.25-rc1 and earlier than 2.6.31 on x86. The kvm_emulate_hypercall implementation fails to restrict MMU hypercalls by CPL, enabling a local guest user to crash the guest kernel and read/write guest memory via unspecified addresses. Root cause: CPL check...

CVE-2009-3290

The kvmemulatehypercall function in arch/x86/kvm/x86.c in KVM in the Linux kernel 2.6.25-rc1, and other versions before 2.6.31, when running on x86 systems, does not prevent access to MMU hypercalls from ring 0, which allows local guest OS users to cause a denial of service guest kernel crash and...

CVE-2009-1837

Race condition in the NPObjWrapperNewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for...

DSA-1787-1 linux-2.6.24 - several vulnerabilities

Bulletin has no description...