Re: Concurrency-related vulnerabilities in browsers - expect problems

Here's another separate issue that typically causes fault on memory access to website-influenced memory access: http://lcamtuf.coredump.cx/ffoxdie3.html This is separate from the previously presented example which, remarkably, also had a tendency to trigger an unrelated call stack overflow due to...

CVE-2006-3227

Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, whi...

CVE-2006-3227

Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, whi...

CVE-2006-3227

CVE-2006-3227 describes an interpretation conflict between Internet Explorer and other browsers (e.g., Mozilla/Firefox/Opera) that may let remote attackers alter the visual presentation of web pages and potentially bypass protection mechanisms by using ASCII characters with the 8th bit set. IE ma...

Microsoft Internet Explorer 5.56.07.0 - JavaScript Key Filtering

Microsoft Internet Explorer 5.56.07.0 - JavaScript Key Filtering source: https://www.securityfocus.com/bid/18308/info Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users. This issue is demonstrated to...

Sun Java Runtime Environment 1.31.41.5 - Nested Array Objects Denial of Service

Sun Java Runtime Environment 1.31.41.5 - Nested Array Objects Denial of Service source: https://www.securityfocus.com/bid/18058/info The Sun Java Runtime Environment is vulnerable to a denial-of-service vulnerability. This issue is due to the software's failure to handle exceptional conditions...

Sun Java Runtime Environment 1.3/1.4/1.5 - Nested Array Objects Denial of Service

source: https://www.securityfocus.com/bid/18058/info The Sun Java Runtime Environment is vulnerable to a denial-of-service vulnerability. This issue is due to the software's failure to handle exceptional conditions. This issue is reported to affect Java Runtime Environment versions up to 1.4.211...

[SECURITY] [DSA 1046-1] New Mozilla packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1046-1 [email protected] http://www.debian.org/security/ Martin Schulze April 27th, 2006 http://www.debian.org/security/faq -...

OCE 3121/3122 Printer (parser.exe) Denial of Service Exploit

Exploit for hardware platform in category dos / poc ============================================================ OCE 3121/3122 Printer parser.exe Denial of Service Exploit ============================================================ !/usr/bin/perl OCE 3121/3122 Printer DoS Exploit...

security flaw

Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by 1 "using a modal alert to suspend an event handler while a new page is being loaded", 2 using eval, and using...

[Full-disclosure] Fun with DHTML

How bugs can you find in your browser? The recent IE issues only scratched the service of the DHTML/behavior bugs. The HTML/JS page below can be used to find all sorts of bugs in different browsers. I stopped caring about these after the first three invalid derefences...

Microsoft Internet Explorer 5.0.1 - Script Action Handler Buffer Overflow

source: https://www.securityfocus.com/bid/17131/info Microsoft Internet Explorer is susceptible to a remote buffer-overflow vulnerability in 'MSHTML.DLL'. The application fails to properly bounds-check user-supplied input data before copying it into an insufficiently sized memory buffer. Remote...

Adobe Macromedia Shockwave Player ActiveX installer buffer overflow vulnerability

Overview The ActiveX installer for Adobe Macromedia Shockwave contains a buffer overflow, which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Shockwave Player Adobe Macromedia Shockwave Player is software that plays active web content...

wmp_plugin_ms06_006.pm.txt

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Cross site scripting

Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting XSS attacks via style sheet specifiers with invalid 1 "/" and "/" comments, or 2 a newline in a "url" specifier, which is processed by certain web browsers...

CVE-2006-0195

Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting XSS attacks via style sheet specifiers with invalid 1 "/" and "/" comments, or 2 a newline in a "url" specifier, which is processed by certain web browsers...

CVE-2006-0800

Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting XSS attacks via HTML tags with a trailing "" character by some web browsers but bypasses the blacklist protection in 1 the pnVarCleanFromInput function in pnAPI.php, 2 the pnSecureInput...

MS Windows Media Player 9 Plugin Overflow Expl (MS06-006) (meta)

Exploit for unknown platform in category remote exploits =================================================================== MS Windows Media Player 9 Plugin Overflow Exploit MS06-006 meta =================================================================== This file is part of the Metasploit...

Microsoft Windows Media Player 9 - Plugin Overflow (MS06-006) (Metasploit)

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...

Microsoft Security Bulletin MS06-006 Vulnerability in Windows Media Player Plug-in with Non-Microsoft Internet Browsers Could Allow Remote Code Execution (911564)

Microsoft Security Bulletin MS06-006 Vulnerability in Windows Media Player Plug-in with Non-Microsoft Internet Browsers Could Allow Remote Code Execution 911564 Published: February 14, 2006 Version: 1.0 Summary Who should read this document: Customers who use a Microsoft Windows Media Player...