OpenOffice.org: Array index error by scanning document typography information of certain *.doc files

Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org OOo 2.x and 3.x before 3.3 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via crafted typography information in a Microsoft Word .DOC fi...

ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)

This module exploits a stack-based buffer overflow in versions 1.2 through 1.3.0 of ProFTPD server. The vulnerability is within the "sreplace" function within the "src/support.c" file. The off-by-one heap overflow bug in the ProFTPD sreplace function has been discovered about 2 two years ago by...

Ubuntu Update for clamav vulnerabilities USN-1031-1

Ubuntu Update for Linux kernel vulnerabilities USN-1031-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10311.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for clamav vulnerabilities USN-1031-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-1031-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2010-4261

Off-by-one error in the iconcb function in peicons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third...

Memory corruption

Off-by-one error in the iconcb function in peicons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third...

PT-2010-5383 · Cisco · Clamav

Name of the Vulnerable Software and Affected Versions: ClamAV versions prior to 0.96.5 Description: The issue is related to an off-by-one error in the icon cb function in pe icons.c in libclamav. This error can be exploited by remote attackers to cause a denial of service, resulting in memory...

kernel: wireless: fix 64K kernel heap content leak via ioctl

The cfg80211wextgiwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctlstandardiwpoint function in net/wireless/wext-core.c, an...

FreeBSD : FreeBSD -- OPIE off-by-one stack overflow (768cfe70-ca40-11df-aade-0050568f000c)

A programming error in the OPIE library could allow an off-by-one buffer overflow to write a single zero byte beyond the end of an on-stack buffer. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

CVE-2010-1773

CVE-2010-1773 is an off-by-one vulnerability in WebKit’s WebCore: the toAlphabetic() routine in rendering/RenderListMarker.cpp contains an error in WebKit prior to r59950. This affects WebKit-based stacks (e.g., Chrome older than 5.0.375.70) and allows remote attackers to read sensitive informati...

Design/Logic Flaw

The cfg80211wextgiwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctlstandardiwpoint function in net/wireless/wext-core.c, an...

CVE-2010-2955

The cfg80211wextgiwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctlstandardiwpoint function in net/wireless/wext-core.c, an...

CVE-2010-2955

The CVE-2010-2955 issue affects the Linux kernel before 2.6.36-rc3-next-20100831, specifically the cfg80211_wext_giwessid function in net/wireless/wext-compat.c, which fails to initialize certain structure members. This enables a local attacker to exploit an off-by-one error in ioctl_standard_iw_...

Ghostscript Arbitrary Code Execution Vulnerability

This host is installed with Ghostscript and is prone to arbitrary code execution vulnerability. OpenVAS Vulnerability Test $Id: gbghostscriptcodeexecvuln.nasl 5306 2017-02-16 09:00:16Z teissa $ Ghostscript Arbitrary Code Execution Vulnerability. Authors: Sooraj KS Copyright: Copyright c 2010...

CVE-2010-2955

The cfg80211wextgiwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctlstandardiwpoint function in net/wireless/wext-core.c, an...

Ghostscript Arbitrary Code Execution Vulnerability

Ghostscript is prone to an arbitrary code execution vulnerability. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

DEBIAN-CVE-2009-3743

Off-by-one error in the InsMINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a malformed TrueType font in a document that trigger an integer overflow and a...

Integer overflow

Off-by-one error in the InsMINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a malformed TrueType font in a document that trigger an integer overflow and a...

PHP 5.3.3 - ibase_gen_id() Off-by-One Overflow

PHP 5.3.3 - ibasegenid Off-by-One Overflow === Vulnerability === PHP 5.3.3 Possible All versions ibasegenid off-by-one overflow === Author === cb === Description === User-supplied variable "generator" copied to 128 byte buffer "query" size of query variable. So its cause off-by-one overflow. You...

PHP 5.3.3 - 'ibase_gen_id()' Off-by-One Overflow

=== Vulnerability === PHP 5.3.3 Possible All versions ibasegenid off-by-one overflow === Author === cb === Description === User-supplied variable "generator" copied to 128 byte buffer "query" size of query variable. So its cause off-by-one overflow. You can see 1 snprintf copy statement to "query...