UBUNTU-CVE-2017-3226

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC encryption feature using environment encryption i.e., setting the configuration parameter CONFIGENVAES=y read environment variables from disk as the encrypte...

Remote Code Execution Bug Found in Ubuntu Quantal

A remote code execution bug has been patched in the default installation of Ubuntu Desktop affecting all default installations of Quantal version 12.10 and later. According to researcher Donncha O’Cearbhaill, the bug allows for code injection when a user opens a specially crafted malicious file...

CVE-2015-3412: Exposure of Sensitive Information to an Unauthorized Actor

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the streamresolveincludepath function in ext/standard/streamsfuncs.c, as...

grep security and bug fix update

2.20-2 - Fixed invalid UTF-8 byte sequence error in PCRE mode by pcre-backported-fixes patch Resolves: rhbz1217080 - Fixed buffer overrun for grep -F Resolves: CVE-2015-1345 - Fixed \w and \W behaviour in multibyte locales Resolves: rhbz1159012 - Documented --fixed-regexp option Resolves:...

freeSSHd 1.3.1 - Denial of Service Vulnerability

Exploit for windows platform in category dos / poc ''' Exploit title: freesshd 1.3.1 denial of service vulnerability Date: 28-8-2015 Vendor homepage: http://www.freesshd.com Software Link: http://www.freesshd.com/freeSSHd.exe Version: 1.3.1 Author: 3unnym00n Details:...

Authentication flaw

IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service disk consumption via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1987...

Authentication flaw

IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service disk consumption via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987...

CVE-2015-5380

The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in Google V8, as used in Node.js before 0.12.6, io.js before 1.8.3 and 2.x before 2.3.3, and other products, does not verify that there is memory available for a UTF-16 surrogate pair, which allows remote attackers to cause a deni...

CVE-2012-1437

The Microsoft Office file parser in Comodo Antivirus 7425 allows remote attackers to bypass malware detection via an Office file with a \50\4B\53\70\58 character sequence at a certain location...

CVE-2012-1435

The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a...

Design/Logic Flaw

lsassd in Likewise Open /Enterprise 5.3 before build 7845, Open 6.0 before build 8325, and Enterprise 6.0 before build 178, as distributed in VMware ESXi 4.1 and ESX 4.1 and possibly other products, allows remote attackers to cause a denial of service daemon crash via an Active Directory login...

Cross site scripting

The htmlspecialchars function in PHP before 5.2.12 does not properly handle 1 overlong UTF-8 sequences, 2 invalid ShiftJIS sequences, and 3 invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting XSS attacks by placing a crafted byte sequence before a special...

CVE-2003-1478

Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service core dump via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm...

CVE-2003-1478: Improper Restriction of Operations within the Bounds of a Memory Buffer

Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service core dump via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm...

CVE-2005-3399

Multiple interpretation error in CAT-QuickHeal 8.0 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a...

CVE-2005-3372

Multiple interpretation error in eTrust CA 7.0.1.4 with the 11.9.1 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could...

CVE-2005-3382

Multiple interpretation error in Sophos 3.91 with the 2.28.4 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be...

CVE-2005-3380

Multiple interpretation error in Panda Titanium 2005 4.02.01 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be execut...

CVE-2005-3373

The CVE-2005-3373 entry describes a vulnerability in Dr.Web 4.32b where an interpretation error in the virus scanner allows a crafted file (e.g., BAT, HTML, or EML) containing an MZ magic byte sequence (normally for EXE) to be treated as a safe type, yet still be executable as a dangerous file by...

CVE-2005-3381

The CVE-2005-3381 entry concerns Ukrainian National Antivirus (UNA) 1.83.2.16 on kernel 265, where a multiple interpretation error in the file-type handling allows bypass of virus scanning. An attacker can supply a file (BAT, HTML, or EML) containing an MZ executable-like magic byte sequence that...