CVE-2009-0029

The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service...

CVE-2009-0029

This CVE affects the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms. The root cause is that a 32-bit user-space argument in a 64‑bit register was not verifiably sign-extended when passed to a system call, allowing local users to crash the kernel or potentiall...

CVE-2009-0029

The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service...

Linux Kernel 64 Bit ABI系统调用参数特权提升漏洞

BUGTRAQ ID: 33275 CVE ID：CVE-2009-0029 Linux是一款开放源代码的操作系统。 Linux内核64位ABI系统调用参数处理存在问题，本地攻击者可以利用漏洞提升特权。 部分结构的ABI定义函数调用者必须对每个参数进行符号扩展来填满寄存器宽度，在linux系统调用处理上存在问题。 如在64位上使用这个系统调用： asmlinkage long sysexampleunsigned int index if index 5 return -EINVAL; return examplearrayindex;...

[slackware-security] gnutls

New gnutls packages are available for Slackware 12.0, 12.1, and -current to fix a security issue. NOTE: The package for 12.0 has a different shared library soname, and the packages for 12.1 and -current have an API/ABI change. Only the Pidgin package in Slackware links with GnuTLS, and upgraded...

Gentoo Security Advisory GLSA 200803-22 (live)

The remote host is missing updates announced in advisory GLSA 200803-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Security fix for the ALT Linux 5 package libxml2 version 1:2.6.32-alt3

Sept. 1, 2008 Alexey Tourbin 1:2.6.32-alt3 - upstream update for CVE-2008-3281 to avoid ABI issues...

Fedora 7 : xine-lib-1.1.11.1-1.fc7 (2008-2945)

This updates xine-lib to 1.1.11.1, which fixes the following security vulnerabilities: CVE-2008-0073 array indexing fixed in 1.1.11, CVE-2008-1482 integer overflow fixed in 1.1.11.1. It also provides a versioned xine-lib plugin-abi so 3rd party packages installing plugins can use it instead of...

CVE-2008-1549

CVE-2008-1549 documents multiple SQL injection vulnerabilities in Eagle Software’s Aeries Browser Interface (ABI) 3.8.3.14 within the Aries Student Information System. The vulnerabilities allow remote attackers to execute arbitrary SQL commands via the GrdBk parameter to GradebookOptions.asp and ...

CVE-2008-1548

CVE-2008-1548 describes multiple XSS vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 within Eagle Software’s Aries Student Information System. The issues allow remote attackers to inject arbitrary web script or HTML via (1) the UserName parameter to loginproc.asp and (2) the usr parame...

Memory corruption

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

CVE-2008-1367

CVE-2008-1367 corresponds to a Linux kernel issue where gcc 4.3.x may not emit a cld instruction while compiling string manipulation code (e.g., memcpy/memmove), preventing the direction flag (DF) from being reset and potentially causing memory copy in the wrong direction during signal handling. ...

CVE-2008-1367

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag DF from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signa...

LIVE555 Media Server: Denial of service

Background LIVE555 Media Server is a set of libraries for multimedia streaming. Description Luigi Auriemma reported a signedness error in the parseRTSPRequestString function when processing short RTSP queries. Impact A remote attacker could send a specially crafted RTSP query to the vulnerable...

Sql injection

SQL injection vulnerability in GradebookStuScores.asp in Eagle Software Aeries Browser Interface ABI 3.8.2.8 allows remote attackers to execute arbitrary SQL commands via the GrdBk parameter...

Sql injection

Multiple SQL injection vulnerabilities in Eagle Software Aeries Browser Interface ABI 3.7.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 FC parameter to Comments.asp, or the Term parameter to 2 Labels.asp or 3 ClassList.asp...

Cross site scripting

Cross-site scripting XSS vulnerability in Eagle Software Aeries Browser Interface ABI 3.8.2.8 allows remote authenticated users to inject arbitrary web script or HTML via an event...

CVE-2008-0943

CVE-2008-0943 describes multiple SQL injection vulnerabilities in Eagle Software Aeries Browser Interface (ABI) 3.7.2.2. The flaws allow remote attackers to execute arbitrary SQL commands via (1) the FC parameter to Comments.asp, or the Term parameter to (2) Labels.asp or (3) ClassList.asp. The C...