[CORE-2010-0623] Microsoft Windows CreateWindow function callback vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ Microsoft Windows CreateWindow function callback vulnerability 1. Advisory Information Title: Microsoft Windows CreateWindow function callback vulnerability Advisory Id:...

Microsoft Windows CreateWindow Function Callback Vulnerability (MS10-048)

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ Microsoft Windows CreateWindow function callback vulnerability 1. Advisory Information Title: Microsoft Windows CreateWindow function...

Microsoft Windows CreateWindow function callback vulnerability

Core Security - CoreLabsMicrosoft Windows CreateWindow function callback vulnerability 1. Advisory Information Title: Microsoft Windows CreateWindow function callback vulnerability Advisory Id: CORE-2010-0623 Advisory URL:...

Fedora 13 : kvirc-4.0.0-3.fc13 (2010-11506)

Fix for security issue: remote command execution. https://svn.kvirc.de/kvirc/ticket/858 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible witho...

Fedora 12 : pcsc-lite-1.5.2-5.fc12 (2010-10764)

This update fixes up incorrect checks which were introduced with CVE-2010-0407 patch, introducing a regression for certain token types. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatical...

Panda AntiVirus Zoo Denial of Service Vulnerability

Panda Software Antivirus/Internet Security before 20070402 allows remote attackers to cause a denial of service infinite loop via a ZOO archive with a direntry structure that points to a previous file. OpenVAS Vulnerability Test Panda AntiVirus Zoo Denial of Service Vulnerability LSS-NVT-2010-038...

Fedora 11 : nss-3.12.6-1.2.fc11 (2010-3905)

Update to NSS 3.12.6 The primary feature of NSS 3.12.6 is support for the TLS Renegotiation Indication Extension, RFC 5746. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Fedora 13 : zikula-1.2.3-1.fc13 (2010-8501)

Upstream pushed this release to fix two security issues one XSS, and one CSRF Upstream also removed a non-free JavaScript library that we previously had to strip. http://community.zikula.org/module-News-display-sid-3012.htm Note that Tenable Network Security has extracted the preceding descriptio...

Fedora 12 : squid-3.1.0.16-6.fc12 (2010-3064)

Denial of service issue in HTCP processing SQUID-2010:2 http://www.squid- cache.org/Advisories/SQUID-20102.txt Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as...

Novell iManager Multiple Vulnerabilities

Novell iManager Multiple Vulnerabilities 1. Advisory Information Title: Novell iManager Multiple Vulnerabilities Advisory Id: CORE-2010-0316 Advisory URL: http://www.coresecurity.com/content/novell-imanager-buffer-overflow-off-by-one-vulnerabilities Date published: 2010-06-23 Date of last update:...

Symantec Workspace Streaming Potential Unauthorized Downloads

SUMMARY Symantecs Workspace Streaming client fails to properly authenticate with the Symantec Workspace Streaming server when downloading files. This could potentially lead to unauthorized download of arbitrary code to a client system. AFFECTED PRODUCTS Products Affected Product | Version | Build...

Microsoft Windows帮助和支持中心绕过白名单限制漏洞

BUGTRAQ ID: 40725,40721 CVE ID: CVE-2010-1885 Windows是微软发布的非常流行的操作系统。 Windows中默认提供了帮助和支持中心以访问在线文档，可通过hcp://形式的URL直接访问帮助文档。在通过注册的协议处理器调用hcp:// URL时，会向帮助中心应用传送命令行参数/fromhcp，这个标记将帮助中心切换到受限制的模式，仅允许白名单中的帮助文档和参数。但这个白名单实现并不安全，可能被绕过。 在进行验证之前首先要使用MPC::HTML::UrlUnescapeW函数规范化和转义URL，该函数使用MPC::HexToNum将...

MySQL COM_FIELD_LIST命令远程溢出漏洞

BUGTRAQ ID: 40106 CVE ID: CVE-2010-1850 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 远程攻击者可以通过向MySQL数据库提交包含有超长表格名称参数的COMFIELDLIST命令触发缓冲区溢出，导致执行任意代码。 MySQL 5.1/5.0 厂商补丁： Oracle ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://bugs.mysql.com/bug.php?id=53237...

Google Chrome < 4.1.249.1064 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is earlier than 4.1.249.1064. Such versions are reportedly affected by multiple vulnerabilities : - A cross-origin bypass in Google URL GURL. Issue 40445 - An HTML5 media handling issue could lead to memory corruption. Issue 40487 - A font...

OpenOffice VBA Macro Restrictions Remote Security Bypass Vulnerability

Bugtraq ID:38245 CVE:CVE-2010-0136 OpenOffice is prone to a remote security-bypass vulnerability. An attacker can exploit this issue to bypass intended restrictions on macro code, which may allow the attacker to obtain sensitive information or launch further attacks. Details on this issue are not...

Virtual PC Hypervisor Memory Protection Vulnerability

1. Advisory Information Title: Virtual PC Hypervisor Memory Protection Vulnerability Advisory Id: CORE-2009-0803 Advisory URL:http://www.coresecurity.com/core-labs/advisories/virtual-pc-2007-hypervisor-memory-protection-bug Date published: 2010-03-16 Date of last update: 2010-03-16 Vendors...

SpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection Vulnerability

SpamAssassin Milter Plugin is prone to a remote command- injection vulnerability because it fails to adequately sanitize user-supplied input data. Remote attackers can exploit this issue to execute arbitrary shell commands with root privileges. SpamAssassin Milter Plugin 0.3.1 is affected; other...

Microsoft Excel对象类型混淆远程代码执行漏洞（MS10-017）

BUGTRAQ ID: 38550 CVE ID: CVE-2010-0258 Excel是微软Office套件中的电子表格工具。 Excel在解析XSL文件中畸形BRAI BIFF记录时存在内存破坏漏洞。在这种情况下，多个记录之间所共享的包含有识别对象类型字段的记录可能导致类型混淆。用户受骗打开了特制的Excel文档就可以触发这个漏洞。通过控制所分配堆块边界之外的内存，攻击者就可以控制虚函数调用中所使用的C++对象指针，导致将内存区处理为不同的对象类型，越界访问所分配的对象。 Microsoft Excel Viewer SP2 Microsoft Excel Viewer SP1...

Microsoft Windows .ani文件tagBITMAPINFOHEADER拒绝服务漏洞

BUGTRAQ ID: 38579 Microsoft Windows是微软发布的非常流行的操作系统。 ANI文件将动画光标的每一帧存储为文件中的打包位图，每个位图的BITMAPINFOHEADER中的每个DWORD biClrUsed成员都可能导致Windows API函数分配任意数量的字节，并向新分配的内存中拷贝进同样数量的数据。由于代码没有检查是否有上述数量的数据可用，这可能导致拷贝操作读过为ANI文件所分配内存的边界。 如果很小的ANI文件对biClrUsed指定了很大的值，内存拷贝操作就可能越界，进入未分配的内存区。IE等应用程序使用这些Windows...

Microsoft Office Excel / Word OfficeArtSpgr Container Pointer Overwrite Vulnerability

Advisory ID Internal CORE-2009-0827 1. Advisory Information Title: Microsoft Office Excel / Word OfficeArtSpgr Container Pointer Overwrite Vulnerability Advisory Id: CORE-2009-0827 Date published: 2010-02-09 Date of last update: 2010-02-08 Vendors contacted: Microsoft Release mode: Coordinated...