Debian Security Advisory DSA 1616-2 (clamav)

The remote host is missing an update to clamav announced via advisory DSA 1616-2. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 1616-1] new clamav packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1616-1 [email protected] http://www.debian.org/security/ Devin Carraway July 24, 2008 http://www.debian.org/security/faq -...

CVE-2008-1054

Stack-based buffer overflow in the libspawnusergetpid function in 1 swatch.exe and 2 surgemail.exe in NetWin SurgeMail 38k4 and earlier, and beta 39a, allows remote attackers to cause a denial of service daemon crash and possibly execute arbitrary code via an HTTP request with multiple long heade...

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain privileges via certain vectors related to 1 DB2 instance or FMP startup on Linux and Solaris; 2 exec of executables while running as root on non-Windows systems, as...

CVE-2007-4275

Multiple untrusted search path vulnerabilities in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain privileges via certain vectors related to 1 DB2 instance or FMP startup on Linux and Solaris; 2 exec of executables while running as root on non-Windows systems, as...

Design/Logic Flaw

Panda Antivirus 2008 stores service executables under the product's installation directory with weak permissions, which allows local users to obtain LocalSystem privileges by modifying PAVSRV51.EXE or other unspecified files, a related issue to CVE-2006-4657...

Symantec Mail Security for SMTP buffer overflow

Buffer overflow on packed executables parsing...

SOL7593 - Command injection into F5 ActiveX control

A vulnerability exists in an F5 ActiveX control. The ActiveX control is downloaded to a Windows client system when you log in to a FirePass controller, which is configured for specific pre-logon sequence functionality. The ActiveX control could run executables that reside on the system if an...

Directory traversal

Directory traversal vulnerability in am.pl in 1 SQL-Ledger 2.6.27 and earlier, and 2 LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. dot dot sequence and trailing NULL %00 in the login parameter. NOTE: this issue was reportedly...

CVE-2007-1541

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL %00 character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. dot dot sequence in the login paramete...

CVE-2007-1540

Directory traversal vulnerability in am.pl in 1 SQL-Ledger 2.6.27 and earlier, and 2 LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. dot dot sequence and trailing NULL %00 in the login parameter. NOTE: this issue was reportedly...

CVE-2007-1541

Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL %00 character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. dot dot sequence in the login paramete...

JVN#80126589 CCC Cleaner division-by-zero vulnerability when scanning UPX-packed executables

Impact When CCC cleaner scans a malicious UPX-packed executable file, CCC cleaner or the system itself may crash. Solution Products Affected CCC Cleaner CCC pattern Ver:321 and earlier For more information, refer to the vendor's website...

PT-2007-1420 · Utimaco · Utimaco Safeguard

Name of the Vulnerable Software and Affected Versions: Utimaco Safeguard affected versions not specified Description: The centralized management feature of Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files. This allows attackers to...

Data URLs with executables and misleading download dialog

The data URL scheme allows authors to embed binary files,instead of using links to external files. Data URLscontaining file types that Opera can display are renderedinline; other file types will be handled by Opera'sdownload dialog. A bug in Opera's file download handling causes the downloaddialo...

Vulnerability in Opera's use of kfmclient

The kfmclient is a part of the KDE desktop environment.It inspects the file given to it to determine its MIMEtype, and performs the action assigned to that MIME typein KDE's configuration. If the file type is an executable,kfmclient may execute it.Opera will not save downloaded files with the...

Mandrake Linux Security Advisory : clamav (MDKSA-2006:138)

Damian Put discovered a boundary error in the UPX extraction module in ClamAV which is used to unpack PE Windows executables. This could be abused to cause a Denial of Service issue and potentially allow for the execution of arbitrary code with the permissions of the user running clamscan or clam...

WebEx Downloader Plug-in Code Execution Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the WebEx Downloader Plug-in. Successful exploitation requires that the target user browse to a malicious web page. The specific flaws exists due to the lack of input validation on various ActiveX/Java...

CentOS 3 / 4 : ethereal (CESA-2005:687)

Updated Ethereal packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The ethereal package is a program for monitoring network traffic. A number of security flaws have been...

mozilla -- multiple vulnerabilities

A Mozilla Foundation Security Advisory reports of multiple issues. Several of which can be used to run arbitrary code with the privilege of the user running the program. MFSA 2006-29 Spoofing with translucent windows MFSA 2006-28 Security check of jsValueToFunctionObject can be circumvented MFSA...