Design/Logic Flaw

The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the 1 Console or 2 Controls property, which allows...

Microsoft Excel Data Validation Record Heap Memory Corruption Vulnerability

Description Microsoft Excel is prone to a heap memory-corruption vulnerability. Attackers may exploit this issue by enticing victims into opening a maliciously crafted Excel file '.xls'. Successful exploits may allow attackers to execute arbitrary code with the privileges of the user running the...

RealNetworks RealPlayer ActiveX controls property heap memory corruption

Overview Multiple RealPlayer ActiveX controls fail to properly handle properties, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description RealNetworks RealPlayer provides multiple ActiveX controls to allow integration with Internet Explorer...

Mozilla Firefox / Opera information leak

Error on BMP files displaying allows to read content of heap memory...

MPlayer 1.0rc2 - demux_mov.c Remote Code Execution

MPlayer 1.0rc2 - demuxmov.c Remote Code Execution source: https://www.securityfocus.com/bid/27499/info MPlayer is prone to a remote code-execution vulnerability because it fails to sanitize certain 'MOV' file tags before using them to index heap memory. An attacker can exploit this issue to execu...

MPlayer 1.0rc2 - 'demux_mov.c' Remote Code Execution

source: https://www.securityfocus.com/bid/27499/info MPlayer is prone to a remote code-execution vulnerability because it fails to sanitize certain 'MOV' file tags before using them to index heap memory. An attacker can exploit this issue to execute arbitrary code, which can result in the complet...

Debian: Security Advisory (DSA-781-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 10 Security Update : Samba (ZYPP Patch Number 3351)

Specially crafted MS-RPC packets could overwrite heap memory and therfore could potentially be exploited to execute code. CVE-2007-2446 Authenticated users could leverage specially crafted MS-RPC packets to pass arguments unfiltered to /bin/sh. CVE-2007-2447 %NASLMINLEVEL 70300 C Tenable Network...

Ubuntu 5.10 / 6.06 LTS / 6.10 : file vulnerability (USN-439-1)

Jean-Sebastien Guay-Leroux discovered that 'file' did not correctly check the size of allocated heap memory. If a user were tricked into examining a specially crafted file with the 'file' utility, a remote attacker could execute arbitrary code with user privileges. Note that Tenable Network...

Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-485-1)

It was discovered that the PHP xmlrpc extension did not correctly check heap memory allocation sizes. A remote attacker could send a specially crafted request to a PHP application using xmlrpc and execute arbitrary code as the Apache user. CVE-2007-1864 Stefan Esser discovered a flaw in the rando...

Microsoft Outlook Express / Windows Mail NNTP buffer overflow

Heap memory overflow on NNTP server reply parsing...

CVE-2007-4547

Unreal Commander 0.92 build 565 and 573 writes portions of heap memory into local files when extracting from an archive with malformed size information in a file header, which might allow user-assisted attackers to obtain sensitive information memory contents by reading the extracted files. NOTE:...

CVE-2007-4547

Unreal Commander 0.92 build 565 and 573 writes portions of heap memory into local files when extracting from an archive with malformed size information in a file header, which might allow user-assisted attackers to obtain sensitive information memory contents by reading the extracted files. NOTE:...

Microsoft OLE Automation SubstringData Function Integer Overflow Vulnerability

Description Microsoft OLE Automation is prone to an integer-overflow vulnerability. this issue occurs because the application fails to ensure that integer values are not overrun. Successfully exploiting this issue allows remote attackers to corrupt heap memory and execute arbitrary in the context...

Apple QuickTime for Java QTPointerRef heap memory corruption vulnerability

Overview Apple QuickTime for Java contains a heap memory corruption vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Apple QuickTime includes the ability to integrate QuickTime into Java applications and applets. This...

Lighttpd 1.4.15 - Multiple Code Execution Denial of Service Information Disclosure Vulnerabilities

Lighttpd 1.4.15 - Multiple Code Execution Denial of Service Information Disclosure Vulnerabilities source: https://www.securityfocus.com/bid/24967/info Lighttpd is prone to multiple remote denial-of-service vulnerabilities, a code-execution vulnerability, and an information-disclosure...

[Full-disclosure] AOL Nullsoft Winamp S3M Module "IN_MOD.DLL" Remote Heap Memory Corruption

AOL Nullsoft Winamp S3M Module "INMOD.DLL" Remote Heap Memory Corruption by Piotr Bania [email protected] http://www.piotrbania.com Severity: Important - Potencial remote code execution. Software affected: Tested on AOL Nullsoft Winamp v5.33 x86 Feb 13 2007 on Windows XP SP1/SP2. Orginal url:...

[Full-disclosure] AOL Nullsoft Winamp IT Module "IN_MOD.DLL" Remote Heap Memory Corruption

AOL Nullsoft Winamp IT Module "INMOD.DLL" Remote Heap Memory Corruption by Piotr Bania [email protected] http://www.piotrbania.com Severity: Important - Potencial remote code execution. Software affected: Tested on AOL Nullsoft Winamp v5.33 x86 Feb 13 2007 on Windows XP SP1/SP2. Orginal url:...

PHP zip_entry_read() function integer overflow

Integer overflow leads to heap memory buffer overflow...

MOPB-29-2007:PHP 5.2.1 unserialize() Information Leak Vulnerability

Summary The new S: data type added to PHP 5.2.1's serialisation format is completely broken. The new feature it is supposed to add, the handling of escaped strings does not work at all and leads to disclosure of heap memory content. Affected versions Affected is PHP 5.2.1 Detailed information Wit...