SuSE 11 Security Update : PostgreSQL (SAT Patch Number 674)

Remote authenticated users could crash the postgresql server by requesting a conversion with an inappropriate encoding. CVE-2009-0922 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The tex...

SuSE 10 Security Update : icu (ZYPP Patch Number 6422)

icu does not properly handle invalid byte sequences during Unicode conversion. Remote attackers could potentially exploit that to conduct conduct cross-site scripting XSS attacks. CVE-2009-0153 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell,...

Charm Real Converter Pro 6.6 Denial Of Service

""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" """ :::::: :: :: :: :: :: :::: """ """ :: :: :: :: :::::: .. :::: :: """ """ ::::: ::: ::::: :: :: :: :: :: :::: """ """ :: :: :: :: : :: :: :: :: :: :: """ """ :::::: :: :: ::::: :: :::::: :: :: :::: rs.ir """ """ :: """ """ """...

The tips provided right lianliankan-vulnerability warning-the black bar safety net

author:4lert Now on the network on the mention of the right methods varied, in fact, simply summarized, is the overflow, the third-party software bugs, social engineering, mention right. And today we want to discuss is the mention of the right to process some of the skills, master these skills ca...

[SECURITY] Fedora 10 Update: htmldoc-1.8.27-8.fc10

HTMLDOC converts HTML source files into indexed HTML, PostScript, or Portable Document Format PDF files that can be viewed online or printed. With no options a HTML document is produced on stdout. The second form of HTMLDOC reads HTML source from stdin, which allows you to use HTMLDOC as a filter...

openSUSE Security Update : icu (icu-1028)

icu does not properly handle invalid byte sequences during Unicode conversion. Remote attackers could potentially exploit that to conduct conduct cross-site scripting XSS attacks CVE-2009-0153. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

sablog-X v1.6 $page数值类型转换漏洞

sablog是国内安全研究人员写的一款blog程序。数值类型转换存在漏洞。 系统对分页函数$page处理上存在问题。 如果$page的参数为负数的话，程序就会出错。如：http://luoq.net/?page=-1 1是数字，-1就是字符了。暂且叫做数值类型转换上的问题吧。不过没有办法利用。哈哈。比较非主流。 sablog-X v1.6 对$page进行处理。 $page = isset$GET'page' ? max0, intval$GET'page' : 0;...

intval()is used improperly cause a security vulnerability analysis-vulnerability warning-the black bar safety net

author: xy780sec.com from: A description of the classification intval function has two characteristics:"until the encounter on the numbers or the positive and negative symbols before starting to do the conversion, and then encounter non-numeric or string at the end\0end of conversion",in certain...

Integer overflow

Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large 1 width and 2 height values, which triggers a heap-based buffer overflow in the a cvtwholeimage...

ruby: DoS vulnerability in BigDecimal

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service application crash via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type...

CVE-2009-0689

Array index error in the 1 dtoa implementation in dtoa.c aka pdtoa.c and the 2 gdtoa aka new dtoa implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x...

RedHat Security Advisory RHSA-2009:1122

The remote host is missing updates announced in advisory RHSA-2009:1122. A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain conte...

RedHat Security Advisory RHSA-2009:1122

The remote host is missing updates announced in advisory RHSA-2009:1122. A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain conte...

Moderate: Red Hat Security Advisory: icu security update

Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The International Components for Unicode ICU library provides robust and full-featured Unicode...

Stack overflow

Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the 1 xcf2pnm and 2 xcf2png utilities, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted image that causes a conversion to ...

CVE-2009-2175

Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the 1 xcf2pnm and 2 xcf2png utilities, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted image that causes a conversion to ...

Microsoft Windows Search脚本注入漏洞(MS09-023)

BUGTRAQ ID: 35220 CVECAN ID: CVE-2009-0239 Windows Search允许即时搜索大多数公共文件和数据类型，例如电子邮件、联系人、日历约会、文档、照片、多媒体和由第三方扩展的其他格式。 Windows Search通过嵌入式的浏览器向用户预览搜索结果。为了支持非HTML/XML文件，Windows Search会将这类文件转换为HTML，但转换器在转义字符的时候没有执行任何过滤便将文件加载到了内嵌的浏览器中。根据嵌入式浏览器的安全设置，上述本地HTML文件无需用户同意便拥有部分JavaScript执行权限。...

TransLucid 1.75 - Multiple Vulnerabilities

TransLucid 1.75 - Multiple Vulnerabilities transLucid - Cross Site Scripting and HTML Injection Vulnerabilities Version Affected: 1.75 newest Info: transLucidonline is the easy website publishing system with which anyone can create and maintain web content, in multiple languages and based on a...

TransLucid 1.75 - Multiple Vulnerabilities

transLucid - Cross Site Scripting and HTML Injection Vulnerabilities Version Affected: 1.75 newest Info: transLucidonline is the easy website publishing system with which anyone can create and maintain web content, in multiple languages and based on a growing list of ready-made, professional...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service application crash via a string argument that represents a large number, as...