Format string

Format string vulnerability in srsexec in Sun Remote Services SRS Net Connect 3.2.3 and 3.2.4, as distributed in the SRS Proxy Core SUNWsrspx package, allows local users to gain privileges via format string specifiers in unspecified input that is logged through syslog...

CVE-2007-3880

Format string vulnerability in srsexec in Sun Remote Services SRS Net Connect 3.2.3 and 3.2.4, as distributed in the SRS Proxy Core SUNWsrspx package, allows local users to gain privileges via format string specifiers in unspecified input that is logged through syslog...

CVE-2007-3880

CVE-2007-3880 is a format-string vulnerability in the srsexec binary of Sun Remote Services Net Connect (SUNWsrspx), affecting Solaris 8/9/10 via NetConnect 3.2.3/3.2.4. An attacker with local access to a set-UID root srsexec can trigger syslog handling of crafted input containing format specifie...

CVE-2007-3880

Format string vulnerability in srsexec in Sun Remote Services SRS Net Connect 3.2.3 and 3.2.4, as distributed in the SRS Proxy Core SUNWsrspx package, allows local users to gain privileges via format string specifiers in unspecified input that is logged through syslog...

CVE-2007-3880: Use of Externally-Controlled Format String

Format string vulnerability in srsexec in Sun Remote Services SRS Net Connect 3.2.3 and 3.2.4, as distributed in the SRS Proxy Core SUNWsrspx package, allows local users to gain privileges via format string specifiers in unspecified input that is logged through syslog...

DTSA-84-1 perdition - format string vulnerability

Bulletin has no description...

IBM Informix Dynamic Server privilege escalation

Directory traversal on DBLANG environment variable parsing allows to specify attacker-controlled NLS files, leading to possibility of format string attacks for suid applications...

CVE-2007-5396

Miranda IM 0.7.1 is affected by a format-string vulnerability in the ext_yahoo_contact_added function (yahoo.c) that allows remote code execution via a Y7 Buddy Authorization packet containing format specifiers in the contact Yahoo! handle (who). This CVE-2007-5396 issue is triggered by crafted i...

Ubuntu 5.10 / 6.06 LTS / 6.10 : inkscape vulnerability (USN-438-1)

A flaw was discovered in Inkscape's use of format strings. If a user were tricked into opening a specially crafted URI in Inkscape, a remote attacker could execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from t...

Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-321-1)

Jean-David Maillefer discovered a format string bug in the dateformat function's error reporting. By calling the function with invalid arguments, an authenticated user could exploit this to crash the server. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 5.10 / 6.06 LTS / 6.10 : samba vulnerabilities (USN-419-1)

A flaw was discovered in Samba's file opening code, which in certain situations could lead to an endless loop, resulting in a denial of service. CVE-2007-0452 A format string overflow was discovered in Samba's ACL handling on AFS shares. Remote users with access to an AFS share could create craft...

Ubuntu 6.06 LTS / 6.10 : gdm vulnerability (USN-396-1)

A format string vulnerability was discovered in the gdmchooser component of the GNOME Display Manager. By typing a specially crafted host name, local users could gain gdm user privileges, which could lead to further account information exposure. Note that Tenable Network Security has extracted th...

Ubuntu 5.10 / 6.06 LTS / 6.10 : ekiga, gnomemeeting vulnerability (USN-434-1)

It was discovered that Ekiga had format string vulnerabilities beyond those fixed in USN-426-1. If a user was running Ekiga and listening for incoming calls, a remote attacker could send a crafted call request, and execute arbitrary code with the user's privileges. Note that Tenable Network...

Ubuntu 5.10 / 6.06 LTS / 6.10 : ekiga, gnomemeeting vulnerabilities (USN-426-1)

Mu Security discovered a format string vulnerability in Ekiga. If a user was running Ekiga and listening for incoming calls, a remote attacker could send a crafted call request, and execute arbitrary code with the user's privileges. Note that Tenable Network Security has extracted the preceding...

Ubuntu 5.10 / 6.06 LTS / 6.10 : w3m vulnerabilities (USN-399-1)

A format string vulnerability was discovered in w3m. If a user were tricked into visiting an HTTPS URL protected by a specially crafted SSL certificate, an attacker could execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block...

CVE-2007-5396: Use of Externally-Controlled Format String

Format string vulnerability in the extyahoocontactadded function in yahoo.c in Miranda IM 0.7.1 allows remote attackers to execute arbitrary code via a Y7 Buddy Authorization packet with format string specifiers in the contact Yahoo! handle who...

Ubuntu 5.10 / 6.06 LTS / 6.10 : php5 regression (USN-424-2)

USN-424-1 fixed vulnerabilities in PHP. However, some upstream changes were not included, which caused errors in the stream filters. This update fixes the problem. We apologize for the inconvenience. Multiple buffer overflows have been discovered in various PHP modules. If a PHP application...

Ubuntu 6.06 LTS / 6.10 / 7.04 : qt-x11-free vulnerability (USN-495-1)

Several format string vulnerabilities have been discovered in Qt warning messages. By causing an application to process specially crafted input data which triggered Qt warnings, this could be exploited to execute arbitrary code with the privilege of the user running the application. Note that...

texinfo-poc.txt

--==+=============================================+==-- --==+ texinfo = 4.9 format string vuln PoC +==-- --==+=============================================+==-- DISCOVERED BY: Cody Rester WEBSITE: www.codyrester.com --==+=============================================+==-- TIMELINE:...

FreeBSD : perdition -- str_vwrite format string vulnerability (617a4021-8bf0-11dc-bffa-0016179b2dd5)

SEC-Consult reports : Perdition IMAP is affected by a format string bug in one of its IMAP output-string formatting functions. The bug allows the execution of arbitrary code on the affected server. A successful exploit does not require prior authentication. %NASLMINLEVEL 70300 C Tenable Network...