Ubuntu 5.04 / 5.10 / 6.06 LTS : ffmpeg, xine-lib vulnerabilities (USN-358-1)

XFOCUS Security Team discovered that the AVI decoder used in xine-lib did not correctly validate certain headers. By tricking a user into playing an AVI with malicious headers, an attacker could execute arbitrary code with the target user's privileges. CVE-2006-4799 Multiple integer overflows wer...

CentOS 4 / 5 : flac (CESA-2007:0975)

An updated flac package to correct a security issue is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. FLAC is a Free Lossless Audio Codec. The flac package consists of a FLAC encoder and...

openSUSE 10 Security Update : qt3 (qt3-3048)

qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror CVE-2007-0242. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

openSUSE 10 Security Update : libqt4 (libqt4-3056)

qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror CVE-2007-0242. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

QT UTF8 improper character expansion

The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting XSS and directory traversal attacks via long sequences that decode to dangerous metacharacters...

phpsyncml 0.1.2 - Remote File Inclusion

======================================================================== || || || || || || || || || || || || ======================================================================== ======================================================================== phpsyncml = 0.1.2 Remote File Include...

QT UTF8 improper character expansion

The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting XSS and directory traversal attacks via long sequences that decode to dangerous metacharacters...

CVE-2007-4746

The CVE-2007-4746 issue involves Cisco Video Surveillance devices where default passwords exist for sypixx and root accounts. Affected are the Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) firmware 1.8.1 and earlier; Video Surveillance SP/ISP Decoder Software firmwar...

CVE-2007-4747

CVE-2007-4747 concerns Cisco Video Surveillance IP Gateway Encoder/Decoder (Standalone and Module) firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and Video Surveillance SP/ISP firmware 1.23.7 and earlier. The telnet service in these products do...

Cisco Security Advisory: Cisco Video Surveillance IP Gateway and Services Platform Authentication Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Video Surveillance IP Gateway and Services Platform Authentication Vulnerabilities Advisory ID: cisco-sa-20070905-video http://www.cisco.com/warp/public/707/cisco-sa-20070905-video.shtml Revision 1.0 For Public Release...

CVE-2007-4746: Undefined Security Weakness

The Cisco Video Surveillance IP Gateway Encoder/Decoder Standalone and Module firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier have default passwords for the sypixx and root user...

CVE-2007-4747: Improper Authentication

The telnet service in Cisco Video Surveillance IP Gateway Encoder/Decoder Standalone and Module firmware 1.8.1 and earlier, Video Surveillance SP/ISP Decoder Software firmware 1.11.0 and earlier, and the Video Surveillance SP/ISP firmware 1.23.7 and earlier does not require authentication, which...

yEnc32 Decoder超长文件名堆缓冲区溢出漏洞

yEnc32是一款简单易用的GUI y编码器/y解码器。 yEnc32不正确处理文件名数据，远程攻击者可以利用漏洞进行堆溢出攻击，可能以应用程序权限执行任意指令。 当解码包含超长文件名的yEnc编码的文件时，可导致破坏堆缓冲区，精心构建提交数据可能以应用程序权限执行任意指令。 yEnc32 1.0.7.207 升级程序： yEnc32 yEnc32 1.0.7.207 yEnc32 yenc32-108.exe http://superb-east.dl.sourceforge.net/sourceforge/yenc32/yenc32-108.exe...

[vuln.sg] yEnc32 Decoder Long Filename Buffer Overflow Vulnerability

yEnc32 Decoder Long Filename Buffer Overflow Vulnerability by Tan Chew Keong Release Date: 2007-05-12 Ruffled Feathers en jp Summary A vulnerability has been found in yEnc32. When exploited, the vulnerability allows execution of arbitrary code when the user decodes a specially crafted yEnc encode...

Code injection

zoo decoder 2.10 zoo-2.10, as used in multiple products including 1 Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, 2 Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and 3 AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service infinit...

CVE-2007-1669

zoo decoder 2.10 zoo-2.10, as used in multiple products including 1 Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, 2 Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and 3 AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service infinit...

CVE-2007-1669

CVE-2007-1669 describes a DoS in zoo-2.10-based ZOO archive parsing: a direntry that points to a previously processed file can trigger an infinite loop, causing 100% CPU or service unavailability. Affected products include Barracuda Spam Firewall (firmware 3.4+ with virusdef before 2.0.6399, and ...

CVE-2007-1669

zoo decoder 2.10 zoo-2.10, as used in multiple products including 1 Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, 2 Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and 3 AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service infinit...

CVE-2007-1669: Undefined Security Weakness

zoo decoder 2.10 zoo-2.10, as used in multiple products including 1 Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, 2 Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and 3 AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service infinit...

Cross site scripting

The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting XSS and directory traversal attacks via long sequences that decode to dangerous metacharacters...