[Full-disclosure] Layered Defense Advisory: Novell Client 4.91 Format String Vulnerability

================================================== Layered Defense Advisory 1 December 2006 ================================================== 1 Affected Software Novell Client 4.91 SP2 Novell Client 4.91 SP2 Patch Kit Novell Client 4.91 SP3 Earlier versions may also be vulnerable...

CVE-2006-6013

Integer signedness error in the fwioctl FWIOCTL function in the FireWire IEEE-1394 drivers dev/firewire/fwdev.c in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows...

CVE-2006-6013: Undefined Security Weakness

Integer signedness error in the fwioctl FWIOCTL function in the FireWire IEEE-1394 drivers dev/firewire/fwdev.c in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows...

SUSE-SA:2005:071: perl

The remote host is missing the patch for the advisory SUSE-SA:2005:071 perl. Integer overflows in the format string functionality in Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap...

CVE-2005-2119: Undefined Security Weakness

The MIDLuserallocate function in the Microsoft Distributed Transaction Coordinator MSDTC proxy MSDTCPRX.DLL allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAlloca...

CVE-2005-2128: Undefined Security Weakness

QUARTZ.DLL in Microsoft Windows Media Player 9 allows remote attackers to write a null byte to arbitrary memory via an AVI file with a crafted strn element with a modified length value...

CVE-2005-2492

The rawsendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service change hardware state or read from arbitrary memory via crafted input...

CVE-2005-2492

The rawsendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service change hardware state or read from arbitrary memory via crafted input...

CVE-2005-2492: Undefined Security Weakness

The rawsendmsg function in the Linux kernel 2.6 before 2.6.13.1 allows local users to cause a denial of service change hardware state or read from arbitrary memory via crafted input...

CVE-2005-2367

Format string vulnerability in the protoitemsettext function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet...

CVE-2005-2367: Undefined Security Weakness

Format string vulnerability in the protoitemsettext function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet...

CVE-2005-2050: Undefined Security Weakness

Unknown vulnerability in Tor before 0.1.0.10 allows remote attackers to read arbitrary memory and possibly key information from the exit server's process space...

[Full-Disclosure] [ Positive Technologies ] Defeating Microsoft Windows XP SP2 Heap protection

It was discovered by MaxPatrol team that it is possible to defeat Microsoft® Windows® XP SP2 Heap protection and Data Execution Prevention mechanism. As a result it is possible to implement: - Arbitrary memory region write access smaller or equal to 1016 bytes; - Arbitrary code execution; - DEP...

Multiple applications fd_set structure bitmap array index overflow

Absence of control for large number of open file descriptors or sockets FDSETSIZE allow to write arbitrary memory...

USN-66-1: PHP vulnerabilities

FraMe from kernelpanik.org reported that the cURL module does not respect openbasedir restrictions. As a result, scripts which used cURL to open files with an user-specified path could read arbitrary local files outside of the openbasedir directory. Stefano Di Paola discovered a vulnerability in...

Linux Kernel 2.6.7-rc3 (Slackware 9.1 Debian 3.0) - sys_chown() Group Ownership Alteration Privilege Escalation

Linux Kernel 2.6.7-rc3 Slackware 9.1 Debian 3.0 - syschown Group Ownership Alteration Privilege Escalation / $Id: raptorchown.c,v 1.1 2004/12/04 14:44:38 raptor Exp $ raptorchown.c - syschown missing DAC controls on Linux Copyright c 2004 Marco Ivaldi Unknown vulnerability in Linux kernel 2.x may...

PHP 4.x5.0 Shared Memory Module - Offset Memory Corruption

PHP 4.x5.0 Shared Memory Module - Offset Memory Corruption source: https://www.securityfocus.com/bid/12045/info PHP shared memory module shmop is reported prone to an integer handling vulnerability. The issue exists in the PHPFUNCTIONshmopwrite function and is as a result of a lack of sufficient...

Windows FTP Server Format String Vulnerability

Windows FTP Server Format String Vulnerability Credit: Author : Peter Winter-Smith Software: Packages : Windows FTP Server Version : 1.6 and below Vendor : HD Soft/Windows Ftp Server SOFTWARE Vendor Url : http://srv.nease.net/ Vulnerability: Bug Type : 'wscanf' Format String Vulnerability Severit...

SX Design sipd 0.1.20.1.4 - Remote Format String

SX Design sipd 0.1.20.1.4 - Remote Format String source: https://www.securityfocus.com/bid/9236/info sipd has been reported prone to a format string vulnerability that may be triggered remotely. It has been reported that sip URI arguments passed to the affected server are not sufficiently handled...

SX Design sipd 0.1.2/0.1.4 - Remote Format String

source: https://www.securityfocus.com/bid/9236/info sipd has been reported prone to a format string vulnerability that may be triggered remotely. It has been reported that sip URI arguments passed to the affected server are not sufficiently handled. An attacker may place format specifiers in the...