Novell Groupwise Messenger 2.1.0 - Arbitrary Memory Corruption

Luigi Auriemma Application: Novell GroupWise Messenger http://www.novell.com/products/groupwise/ Versions: 8B5D 0C /MOV EBX,DWORD PTR SS:EBP+C 00496E2D | 8B4D F8 MOV ECX,DWORD PTR SS:EBP-8 00496E30 |. 8A47 06 |MOV AL,BYTE PTR DS:EDI+6 00496E33 |. 81E1 FFFF0000 |AND ECX,0FFFF 00496E39 |. 3C 02 |CM...

Oracle Outside In OOXML Relationship Tag Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Outside In. Authentication is not required to exploit this vulnerability. The flaw exists within the sccfut.dll component which is used by multiple vendors, most notably the Novell Groupwise...

CVE-2011-3179

The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command...

Command injection

The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command...

CVE-2011-3179

CVE-2011-3179 affects Novell Messenger Server (formerly GroupWise Messenger): versions 2.1 and 2.2.x prior to 2.2.1, and GroupWise Messenger 2.04 and earlier, are vulnerable to an information-disclosure flaw that allows a remote attacker to read arbitrary memory locations via a crafted command. T...

CVE-2011-3179

The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command...

Novell GroupWise Internet Agent HTTP Interface Stack Buffer Overflow (CVE-2011-0334)

A remote code execution vulnerability has been reported in Novell GroupWise Internet Agent GWIA. The vulnerability is due to insufficient bounds validation while parsing GET or POST Request-URIs from HTTP requests. A remote attacker could exploit this vulnerability by sending a specially crafted...

Preemptive Protection against Novell GroupWise Internet Agent RRULE Weekday Parsing Buffer Overflow (CVE-2011-2662)

A remote code injection and execution vulnerability has been reported in Novell GroupWise Internet Agent GWIA...

Novell Messenger Server < 2.2.1 Memory Information Disclosure

Binary data 6057.prm...

GroupWise Internet Agent < 8.0.2 HP3 iCalendar TZNAME Property Heap Overflow

The version of Novell GroupWise Internet Agent hosted on the remote computer is earlier than 8.0.2 HP3. Such versions are potentially affected by a heap overflow vulnerability due to the way the application parses the TZNAME property of the VTIMEZONE component within a received VCALENDAR message...

Novell Groupwise Client DOCX Loader Relationship Id Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise Client. User interaction is required to exploit this vulnerability in that the target must open a malicious e-mail message. The specific flaw exists within the component responsibl...

Novell Groupwise iCal COMMENT, RRULE, TZNAME Remote Code Execution Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell GroupWise. Authentication is not required to exploit this vulnerability. Multiple flaws exist within the gwwww1.dll module responsible for parsing VCALENDAR data within e-mail messages. When...

CVE-2011-2663

Array index error in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message...

CVE-2011-0333

Heap-based buffer overflow in the NgwiCalVTimeZoneBody::ParseSelf function in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted TZNAME variable in a VCALENDAR attachment in an e-mail message, related to a...

CVE-2011-2219

Unspecified vulnerability in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service daemon crash via unknown vectors, a different vulnerability than CVE-2011-2218...

CVE-2011-2218

Unspecified vulnerability in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service daemon crash via unknown vectors, a different vulnerability than CVE-2011-2219...

CVE-2011-2661

Multiple cross-site scripting XSS vulnerabilities in WebAccess in Novell GroupWise 8.0 before HP3 allow remote attackers to inject arbitrary web script or HTML via the 1 Directory.Item.name or 2 Directory.Item.displayName parameter...

CVE-2011-2662

Integer signedness error in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a negative BYWEEKNO property in a weekly RRULE variable in a VCALENDAR attachment in an e-mail message...

CVE-2011-0334

Stack-based buffer overflow in gwia.exe in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a long HTTP request for a .css file...

Code injection

Unspecified vulnerability in GroupWise Internet Agent GWIA in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service daemon crash via unknown vectors, a different vulnerability than CVE-2011-2218...