Creative Software AutoUpdate Engine - ActiveX Stack Overflow

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ CacheFolder property is vulnerable to stack-based buffer overflow after 260 bytes, @ 512 bytes overwrites SEH and allows code execution reliably. Original Advisory @ http://www.kb.cert.org/vuls/id/501843 and Vulnerability...

Debian DSA-1586-1 : xine-lib - multiple vulnerabilities

Multiple vulnerabilities have been discovered in xine-lib, a library which supplies most of the application functionality of the xine multimedia player. The Common Vulnerabilities and Exposures project identifies the following three problems : - CVE-2008-1482 Integer overflow vulnerabilities exis...

CVE-2008-1964

Stack-based buffer overflow in the demuxnsfsendheaders function in src/demuxers/demuxnsf.c in xine-lib allows remote attackers to have an unknown impact via a long copyright field in an NSF header in an NES Sound file, a different issue than CVE-2008-1878. NOTE: a third party claims that the...

CVE-2008-1964

Stack-based buffer overflow in the demuxnsfsendheaders function in src/demuxers/demuxnsf.c in xine-lib allows remote attackers to have an unknown impact via a long copyright field in an NSF header in an NES Sound file, a different issue than CVE-2008-1878. NOTE: a third party claims that the...

Stack overflow

Stack-based buffer overflow in the demuxnsfsendheaders function in src/demuxers/demuxnsf.c in xine-lib allows remote attackers to have an unknown impact via a long copyright field in an NSF header in an NES Sound file, a different issue than CVE-2008-1878. NOTE: a third party claims that the...

CVE-2008-1964

Stack-based buffer overflow in the demuxnsfsendheaders function in src/demuxers/demuxnsf.c in xine-lib allows remote attackers to have an unknown impact via a long copyright field in an NSF header in an NES Sound file, a different issue than CVE-2008-1878. NOTE: a third party claims that the...

PT-2008-3486 · Xine · Xine-Lib

Name of the Vulnerable Software and Affected Versions: xine-lib affected versions not specified Description: The issue is related to a stack-based buffer overflow in the demux nsf send headers function, located in src/demuxers/demux nsf.c. This overflow can be triggered by a long copyright field ...

xine-lib NES Sound Format Demuxer Buffer Overflow

Hi there Original advisory: http://milw0rm.com/exploits/5458 There's another stack-based buffer overflow in demuxnfs.c line 111: this-copyright = strdup&header0x4E; line 189: char copyright100; line 208: sprintfcopyright, "C s", this-copyright; Regards Laurent Gaffi...

xinelib-overflow.txt

xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications http://xinehq.de/index.php/releases - PoC perl -e 'print "\x4E\x45\x53\x4D\x1A\x01\x01\x01\x80\x80\x18\x8A\x03\x8A...

xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC

No description provided by source. xine-lib = 1.1.12 is prone to a stack-based buffer overflow in the NES Sound Format demuxerdemuxnsf.c. - Code opennsffile: 109: this-title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title,...

xine-lib <= 1.1.12 NSF demuxer Stack Overflow Vulnerability PoC

Exploit for linux platform in category dos / poc =============================================================== xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications...

Xine-Lib 1.1.12 - NSF demuxer Stack Overflow (PoC)

Xine-Lib 1.1.12 - NSF demuxer Stack Overflow PoC xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications http://xinehq.de/index.php/releases - PoC perl -e 'print...

Xine-Lib 1.1.12 - NSF demuxer Stack Overflow (PoC)

xine-lib title = strdup&header0x0E; demuxnsfsendchunk: 122: char title100; 162: sprintftitle, "%s, song %d/%d", this-title, this-currentsong, this-totalsongs; - Affected applications http://xinehq.de/index.php/releases - PoC perl -e 'print "\x4E\x45\x53\x4D\x1A\x01\x01\x01\x80\x80\x18\x8A\x03\x8A...

Pulseaudio: Privilege escalation

Background Pulseaudio is a networked sound server with an advanced plugin system. Description Marcus Meissner from SUSE reported that the padroproot function does not properly check the return value of the system calls setuid, seteuid, setresuid and setreuid when dropping its privileges. Impact A...

[SECURITY] Fedora 7 Update: pulseaudio-0.9.6-2.fc7.1

PulseAudio is a sound server for Linux and other Unix like operating systems. It is intended to be an improved drop-in replacement for the Enlightened Sound Daemon ESOUND...

[SECURITY] Fedora 8 Update: pulseaudio-0.9.8-5.fc8

PulseAudio is a sound server for Linux and other Unix like operating systems. It is intended to be an improved drop-in replacement for the Enlightened Sound Daemon ESOUND...

Debian Security Advisory DSA 565-1 (sox)

The remote host is missing an update to sox announced via advisory DSA 565-1. OpenVAS Vulnerability Test $Id: deb5651.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 565-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-565-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 5 : kernel (RHSA-2007:0993)

Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating system. These ne...

ALSA memory disclosure flaw

The sndmemprocread function in sound/core/memalloc.c in the Advanced Linux Sound Architecture ALSA in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information kernel memory contents via a small count argument, as demonstrate...