CVE-2006-1857

Buffer overflow in SCTP in Linux kernel before 2.6.16.17 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a malformed HB-ACK chunk...

Mandrake Linux Security Advisory : kernel (MDKSA-2006:086)

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel : Prior to Linux kernel 2.6.16.5, the kernel does not properly handle uncanonical return addresses on Intel EM64T CPUs which causes the kernel exception handler to run on the user stack with the wrong GS...

CVE-2006-2271

The ECNE chunk handling in Linux SCTP lksctp before 2.6.17 allows remote attackers to cause a denial of service kernel panic via an unexpected chunk when the session is in CLOSED state...

Code injection

The SCTP-netfilter code in Linux kernel before 2.6.16.13 allows remote attackers to trigger a denial of service infinite loop via unknown vectors that cause an invalid SCTP chunk size to be processed by the foreachsctpchunk function...

mplayer -- Multiple integer overflows

Secunia reports: The vulnerabilities are caused due to integer overflow errors in "libmpdemux/asfheader.c" within the handling of an ASF file, and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in an AVI file. This can be exploited to cause heap-based buffer overflows via a malicious A...

HP Security Digests - HP-UX security bulletins digest

HP Support Information Digests =============================================================================== o Security Bulletin Digest Split ------------------------------ The security bulletins digest has been split into multiple digests based on the operating system HP-UX, MPE/iX, and HP...

CVE-2005-2718

Buffer overflow in adpcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via crafted PCM audio data, as demonstrated using a video file with an audio header containing a large value in a stream format strf chunk...

Microsoft Internet Explorer PNG images buffer overflow

Heap overflow on large specific PNG chunk...

HP-UX Security patch : PHSS_27935

The remote host is missing HP-UX Security Patch number PHSS27935 . SSRT2332 rev.10 Apache Server Chunk Encoding %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid17488;...

HP-UX Security patch : PHSS_27783

The remote host is missing HP-UX Security Patch number PHSS27783 . SSRT2332 rev.10 Apache Server Chunk Encoding %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription scriptid17485;...

CVE-2004-1188

The pnmgetchunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLESIZE, which causes a read operation with a negative length that leads to a buffer overflow via 1 RMFTAG, 2 DATATAG,...

CVE-2004-1188

The CVE-2004-1188 issue is in xine (and frontends like MPlayer) where the pnm_get_chunk function does not verify that the input chunk size is less than PREAMBLE_SIZE. This can cause a read with a negative length, leading to a buffer overflow via tags such as RMF_TAG, DATA_TAG, PROP_TAG, MDPR_TAG,...

CVE-2004-1188

The pnmgetchunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLESIZE, which causes a read operation with a negative length that leads to a buffer overflow via 1 RMFTAG, 2 DATATAG,...

CVE-2004-1188

The pnmgetchunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLESIZE, which causes a read operation with a negative length that leads to a buffer overflow via 1 RMFTAG, 2 DATATAG,...

CVE-2004-0597

Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which 1 the pnghandletRNS function does not properly validate the length of transparency chunk tRNS data, or the 2 pnghandlesBIT or 3...

Debian DSA-536-1 : libpng - several vulnerabilities

Chris Evans discovered several vulnerabilities in libpng : - CAN-2004-0597 Multiple buffer overflows exist, including when handling transparency chunk data, which could be exploited to cause arbitrary code to be executed when a specially crafted PNG image is processed - CAN-2004-0598 Multiple NUL...

CVE-2002-1371

filters/image-gif.c in Common Unix Printing System CUPS 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which allows remote attackers to execute arbitrary code via modified chunk headers, as demonstrated by nogif...

CVE-2002-1371

filters/image-gif.c in Common Unix Printing System CUPS 1.1.14 through 1.1.17 does not properly check for zero-length GIF images, which allows remote attackers to execute arbitrary code via modified chunk headers, as demonstrated by nogif...

CVE-2004-0597

Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which 1 the pnghandletRNS function does not properly validate the length of transparency chunk tRNS data, or the 2 pnghandlesBIT or 3...

libpng fails to properly check length of transparency chunk (tRNS) data

Overview The Portable Network Graphics library libpng contains a remotely exploitable vulnerability, which could lead to arbitrary code execution on an affected system. Description The Portable Network Graphics PNG image format is used as an alternative to other image formats such as the Graphics...