Mozilla Foundation Security Advisory 2008-07

Mozilla Foundation Security Advisory 2008-07 Title: Possible information disclosure in BMP decoder Impact: Moderate Announced: February 19, 2008 Reporter: Gynvael Coldwind // Vexillium Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.12 Thunderbird 2.0.0.12 SeaMonkey 1.1.8...

FreeBSD : mozilla -- multiple vulnerabilities (810a5197-e0d9-11dc-891a-02061b08fc24)

The Mozilla Foundation reports of multiple security issues in Firefox, SeaMonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program. - Web forgery overwrite with div overlay - URL token stealing via stylesheet...

iDefense Security Advisory 02.20.08: Symantec Veritas Storage Foundation Scheduler Service DoS Vulnerability

iDefense Security Advisory 02.20.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 20, 2008 I. BACKGROUND The Veritas Storage Foundation is based on the Veritas File System and Veritas Volume Manager products. It allows virtualization of storage over a variety of platforms. It contain...

Symantec Veritas Storage Foundation VEA组件堆溢出漏洞

BUGTRAQ ID: 25778 CVECAN ID: CVE-2008-0638 Veritas Storage Foundation是用于管理Veritas产品存储的解决方案。 Veritas Storage Foundation在服务组件实现上存在漏洞，远程攻击者可能利用此漏洞控制服务器。 Veritas Storage Foundation的Veritas企业管理员（VEA）组件中的Administrator服务（vxsvc.exe，默认监听于UDP...

ZDI-08-007: Symantec VERITAS Storage Foundation Administrator Service Heap Overflow Vulnerability

ZDI-08-007: Symantec VERITAS Storage Foundation Administrator Service Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-007.html February 20, 2008 -- CVE ID: CVE-2008-0638 -- Affected Vendor: Symantec -- Affected Products: Veritas Storage Foundation 5.0 --...

Symantec Veritas Storage Foundation Scheduler服务远程拒绝服务漏洞

BUGTRAQ ID: 27440 CVECAN ID: CVE-2007-4516 Veritas Storage Foundation是用于管理Veritas产品存储的解决方案。 Veritas Storage Foundation的Veritas Scheduler服务处理畸形用户请求时存在漏洞，远程攻击者可能利用此漏洞导致服务不可用。 如果Veritas Scheduler服务（VxSchedService.exe）接收到了畸形报文，就会触发无效的内存访问，导致该服务崩溃。攻击者无需认证便可以利用这个漏洞，但必须要在服务的4888端口创建TCP会话。 Symantec Verit...

Code injection

The Volume Manager Scheduler Service aka VxSchedService.exe in Symantec Veritas Storage Foundation 5.0 for Windows allows remote attackers to cause a denial of service daemon crash or hang via malformed packets...

Heap overflow

Heap-based buffer overflow in the Veritas Enterprise Administrator VEA service aka vxsvc.exe in Symantec Veritas Storage Foundation 5.0 allows remote attackers to execute arbitrary code via a packet with a crafted value of a certain size field, which is not checked for consistency with the actual...

CVE-2008-0638

Heap-based buffer overflow in the Veritas Enterprise Administrator VEA service aka vxsvc.exe in Symantec Veritas Storage Foundation 5.0 allows remote attackers to execute arbitrary code via a packet with a crafted value of a certain size field, which is not checked for consistency with the actual...

CVE-2007-4516

The Volume Manager Scheduler Service aka VxSchedService.exe in Symantec Veritas Storage Foundation 5.0 for Windows allows remote attackers to cause a denial of service daemon crash or hang via malformed packets...

CVE-2007-4516

Affected product: Symantec Veritas Storage Foundation 5.0 for Windows with the Scheduler Service (VxSchedService.exe). The vulnerability allows remote, unauthenticated attackers to crash or hang the daemon by sending malformed packets over TCP port 4888, leading to a DoS. The issue is tied to rem...

CVE-2008-0638

CVE-2008-0638 affects Symantec VERITAS Storage Foundation 5.0. The Administrator service vxsvc.exe (UDP 3207 by default) is vulnerable to a heap-based buffer overflow: it trusts a user-provided size value and copies into a static heap buffer, enabling remote code execution with SYSTEM privileges ...

CVE-2008-0638

Heap-based buffer overflow in the Veritas Enterprise Administrator VEA service aka vxsvc.exe in Symantec Veritas Storage Foundation 5.0 allows remote attackers to execute arbitrary code via a packet with a crafted value of a certain size field, which is not checked for consistency with the actual...

CVE-2007-4516

The Volume Manager Scheduler Service aka VxSchedService.exe in Symantec Veritas Storage Foundation 5.0 for Windows allows remote attackers to cause a denial of service daemon crash or hang via malformed packets...

Symantec VERITAS Storage Foundation Administrator Service Heap Overflow Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Symantec VERITAS Storage Foundation. Authentication is not required to exploit this vulnerability. The specific flaw resides in the Administrator service, vxsvc.exe, which listens by default on UDP port...

PR06-12: XSS on BEA Plumtree Foundation and AquaLogic Interaction portals

PR06-12: XSS on BEA Plumtree Foundation and AquaLogic Interaction portals Description: BEA Plumtree Foundation portal 6.0 and BEA AquaLogic Interaction 6.1 are vulnerable to a XSS vulnerability affecting the 'name' parameter which is submitted to the '/portal/server.pt' server-side script. Date...

Mozilla Foundation Security Advisory 2008-03

Mozilla Foundation Security Advisory 2008-03 Title: Privilege escalation, XSS, Remote Code Execution Impact: Critical Announced: February 7, 2008 Reporter: mozbugra4, Boris Zbarsky Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.12 Thunderbird 2.0.0.12 SeaMonkey 1.1.8 Descriptio...

Mozilla Foundation Security Advisory 2008-02

Mozilla Foundation Security Advisory 2008-02 Title: Multiple file input focus stealing vulnerabilities Impact: Moderate Announced: February 7, 2008 Reporter: hong, Gregory Fleischer Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.12 SeaMonkey 1.1.8 Description Security researchers hong and...

Mozilla Foundation Security Advisory 2008-08

Mozilla Foundation Security Advisory 2008-08 Title: File action dialog tampering Impact: Moderate Announced: February 7, 2008 Reporter: Michal Zalewski Products: Firefox, Thunderbird Fixed in: Firefox 2.0.0.12 Thunderbird 2.0.0.12 Description Security researcher Michal Zalewski demonstrated that...

Mozilla Foundation Security Advisory 2008-06

Mozilla Foundation Security Advisory 2008-06 Title: Web browsing history and forward navigation stealing Impact: Critical Announced: February 7, 2008 Reporter: David Bloom Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 2.0.0.12 SeaMonkey 1.1.8 Description Mozilla contributor David...