glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library aka glibc 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service segmentati...

glibc: incorrect size calculation in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library aka glibc 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service stack...

Ubuntu: Security Advisory (USN-1502-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for xorg-server USN-1502-1

Ubuntu Update for Linux kernel vulnerabilities USN-1502-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN15021.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for xorg-server USN-1502-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net...

GLSA-201207-05 : pidgin-otr: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201207-05 pidgin-otr: Arbitrary code execution A format string vulnerability has been found in the 'logmessagecb' function in otr-plugin.c. Impact : A remote attacker could possibly execute arbitrary code with the privileges of th...

GLSA-201207-04 : X.Org X Server: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201207-04 X.Org X Server: Privilege escalation The 'LogVHdrMessageVerb' function in log.c contains a format string vulnerability. NOTE: Exposure to this vulnerability is reduced in Gentoo due to X.Org X Server being built with...

pidgin-otr: Arbitrary code execution

Background pidgin-otr messaging allows you to have private conversations over instant messaging. Description A format string vulnerability has been found in the "logmessagecb" function in otr-plugin.c. Impact A remote attacker could possibly execute arbitrary code with the privileges of the proce...

X.Org X Server: Privilege escalation

Background The X Window System is a graphical windowing system based on a client/server model. Description The "LogVHdrMessageVerb" function in log.c contains a format string vulnerability. NOTE: Exposure to this vulnerability is reduced in Gentoo due to X.Org X Server being built with...

php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information memory contents and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the pharstreamflush function,...

CVE-2012-2090

Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to 1...

XM Easy Personal FTP Server 5.30 Format String

!/usr/bin/python XM Easy Personal FTP Server v = 5.30 Remote Format String write4 Exploit exploit by: mrme @netninja/mrmeatcorelan.be Thanks to the Corelan Security Team Note: this is a poc only, and requires the following target environment: Windows Server 23k: - msvcrt.dll v7.0.3790.3959 -...

FreeBSD Ports: pidgin-otr

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Fedora 17 : pidgin-otr-3.2.1-1.fc17 (2012-7948)

New release addresses Format string vulnerability CVE-2012-2369 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additiona...

CVE-2012-2369

Format string vulnerability in the logmessagecb function in otr-plugin.c in the Off-the-Record Messaging OTR pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message...

DEBIAN-CVE-2012-2369

Format string vulnerability in the logmessagecb function in otr-plugin.c in the Off-the-Record Messaging OTR pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message...

CVE-2012-2369

Format string vulnerability in the logmessagecb function in otr-plugin.c in the Off-the-Record Messaging OTR pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message...

CVE-2012-2369

CVE-2012-2369 : A format-string vulnerability in the log_message_cb() function of the pidgin-otr plugin (Off-the-Record Messaging) for Pidgin, up to version before 3.2.1, could allow remote attackers to execute arbitrary code. The flaw is triggered by format specifiers in data used to generate lo...

CVE-2012-2369

Format string vulnerability in the logmessagecb function in otr-plugin.c in the Off-the-Record Messaging OTR pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message...

CVE-2012-2369

Format string vulnerability in the logmessagecb function in otr-plugin.c in the Off-the-Record Messaging OTR pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message...

Debian DSA-2476-1 : pidgin-otr - format string vulnerability

intrigeri discovered a format string error in pidgin-otr, an Off-the-Record Messaging plugin for Pidgin. This could be exploited by a remote attacker to cause arbitrary code to be executed on the user's machine. The problem is only in pidgin-otr. Other applications which use libotr are not...