iDefense Security Advisory 04.17.08: Multiple Vendor OpenOffice QPRO Multiple Heap Overflow Vulnerabilities

iDefense Security Advisory 04.17.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 17, 2008 I. BACKGROUND OpenOffice is an open-source desktop office suite for many of today's popular operating systems. One of the file formats that OpenOffice supports is Quattro Pro QPRO. This format ...

iDefense Security Advisory 04.14.08: ClamAV libclamav PE WWPack Heap Overflow Vulnerability

iDefense Security Advisory 04.14.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 14, 2008 I. BACKGROUND Clam AntiVirus is a multi-platform GPL anti-virus toolkit. ClamAV is often integrated into e-mail gateways and used to scan e-mail traffic for viruses. It supports virus scanning...

iDefense Security Advisory 04.15.08: Oracle Application Express Privilege Escalation Vulnerability

iDefense Security Advisory 04.15.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 15, 2008 I. BACKGROUND Oracle Application Express Oracle APEX, formerly called HTML DB, is a rapid web application development tool for the Oracle database. For more information about Oracle Application...

iDefense Security Advisory 04.09.08: EMC DiskXtender File System Manager Stack Buffer Overflow Vulnerability

iDefense Security Advisory 04.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 09, 2008 I. BACKGROUND EMC DiskXtender is a data backup and migration suite. It consists of several applications that are used to manage storing large quantities of files across multiple storage devices...

iDefense Security Advisory 04.09.08: EMC DiskXtender MediaStor Format String Vulnerability

iDefense Security Advisory 04.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 09, 2008 I. BACKGROUND EMC DiskXtender is a data backup and migration suite. It consists of several applications that are used to manage storing large quantities of files across multiple storage devices...

iDefense Security Advisory 04.09.08: EMC DiskXtender Authentication Bypass Vulnerability

iDefense Security Advisory 04.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 09, 2008 I. BACKGROUND EMC DiskXtender is a data backup and migration suite. It consists of several applications that are used to manage storing large quantities of files across multiple storage devices...

iDefense Security Advisory 04.08.08: Microsoft Windows Graphics Rendering Engine Heap Buffer Overflow Vulnerability

iDefense Security Advisory 04.08.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 08, 2008 I. BACKGROUND Microsoft Windows graphics device interface GDI is the core library used to display graphics and text on the Windows operating system. It is the standard interface through which...

iDefense Security Advisory 04.08.08: Microsoft Windows Graphics Rendering Engine Integer Overflow Vulnerability

iDefense Security Advisory 04.08.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 08, 2008 I. BACKGROUND Microsoft Windows graphics device interface GDI is the core library used to display graphics and text on the Windows operating system. It is the standard interface through which...

iDefense Security Advisory 04.03.08: SCO UnixWare pkgadd Directory Traversal Vulnerability

iDefense Security Advisory 04.03.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 03, 2008 I. BACKGROUND SCO UnixWare is a UNIX operating system that runs on many OEM platforms. The pkgadd command is used to install packages on the system. More information about the product is...

iDefense Security Advisory 04.03.08: Computer Associates Alert Notification Service Multiple RPC Buffer Overflow Vulnerabilities

iDefense Security Advisory 04.03.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 03, 2008 I. BACKGROUND Computer Associates Alert Notification Server is used by several CA products, including eTrust Integrated Threat Management, to provide notifications to console users. II...

[Full-disclosure] iDefense Security Advisory 03.11.08: Microsoft Outlook mailto Command Line Switch Injection

iDefense Security Advisory 03.11.08 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 11, 2008 I. BACKGROUND Microsoft Outlook provides an integrated solution for managing and organizing e-mail messages, schedules, tasks, notes, contacts, and other information. More information is...

[Full-disclosure] iDefense Security Advisory 03.11.08: Microsoft Excel DVAL Heap Corruption Vulnerability

iDefense Security Advisory 03.11.08 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 11, 2008 I. BACKGROUND Microsoft Excel is the spreadsheet application that is included with Microsoft Corp's Office productivity software suite. More information is available at the following website...

iDefense Security Advisory 03.10.08: SAP MaxDB Signedness Error Heap Corruption Vulnerability

iDefense Security Advisory 03.10.08 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 10, 2008 I. BACKGROUND SAP's MaxDB is a database software product. MaxDB was released as open source from version 7.5 up to version 7.6.00. Later versions are no longer open source but are available for...

iDefense Security Advisory 03.10.08: SAP MaxDB sdbstarter Privilege Escalation Vulnerability

iDefense Security Advisory 03.10.08 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 10, 2008 I. BACKGROUND SAP's MaxDB is a database software product. MaxDB was released as open source from version 7.5 up to version 7.6.00. Later versions are no longer open source but are available for...

Mozilla Thunderbird external-body MIME type buffer overflow

Overview Mozilla Thunderbird contains a heap-based buffer overflow which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Mozilla Thunderbird is an open source, cross-platform email and news client. Thunderbird uses Multipurpose Internet...

Mozilla Foundation Security Advisory 2008-12

Mozilla Foundation Security Advisory 2008-12 Title: Heap buffer overflow in external MIME bodies Impact: Critical Announced: February 26, 2008 Reporter: regenrecht, iDefense Products: Thunderbird, SeaMonkey Fixed in: Thunderbird 2.0.0.12 SeaMonkey 1.1.8 Description Security research firm iDefense...

iDefense Security Advisory 02.26.08: Symantec Scan Engine 5.1.2 RAR File Buffer Overflow Vulnerability

iDefense Security Advisory 02.26.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 26, 2008 I. BACKGROUND Symantec Scan Engine is a standalone Anti-Virus Engine that exposes a scanning Application Programming Interface API directly to developers who wish to integrate protection into...

iDefense Security Advisory 02.26.08: Mozilla Thunderbird MIME External-Body Heap Overflow Vulnerability

iDefense Security Advisory 02.26.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 26, 2008 I. BACKGROUND Mozilla Thunderbird is an open source electronic mail client and news reader. Multipurpose Internet Message Extensions MIME is a standard that defines how non-text attachments and...

iDefense Security Advisory 02.20.08: Symantec Veritas Storage Foundation Scheduler Service DoS Vulnerability

iDefense Security Advisory 02.20.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 20, 2008 I. BACKGROUND The Veritas Storage Foundation is based on the Veritas File System and Veritas Volume Manager products. It allows virtualization of storage over a variety of platforms. It contain...

iDefense Security Advisory 02.12.08: ClamAV libclamav PE File Integer Overflow Vulnerability

iDefense Security Advisory 02.12.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 12, 2008 I. BACKGROUND Clam AntiVirus is a multi-platform GPL anti-virus toolkit. ClamAV is often integrated into e-mail gateways and used to scan e-mail traffic for viruses. It supports virus scanning...