VUPEN Security Research - Microsoft Windows OLE Automation Integer Underflow Vulnerability (MS11-038)

VUPEN Security Research - Microsoft Windows OLE Automation Integer Underflow Vulnerability MS11-038 Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Windows is a series of software operating systems and graphical...

CVE-2011-0658

Integer underflow in the OLE Automation protocol implementation in VBScript.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via ...

Integer overflow

Integer underflow in the OLE Automation protocol implementation in VBScript.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via ...

CVE-2011-0658

Integer underflow in the OLE Automation protocol implementation in VBScript.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via ...

CVE-2011-0658

CVE-2011-0658 corresponds to Microsoft Windows OLE Automation Remote Code Execution via a malformed WMF in oleaut32.dll. Public sources (MS11-038) and multiple security analyses describe an integer underflow in the WMF parsing path, leading to arbitrary code execution when a user opens a crafted ...

CVE-2011-2175

Integer underflow in the visualread function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service application crash via a malformed Visual Networks file that triggers a heap-based buffer over-read...

CVE-2011-2175

Integer underflow in the visualread function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service application crash via a malformed Visual Networks file that triggers a heap-based buffer over-read...

CVE-2011-2175

Integer underflow in the visualread function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service application crash via a malformed Visual Networks file that triggers a heap-based buffer over-read...

CVE-2011-2175

Wireshark CVE-2011-2175: An integer underflow in wiretap/visual.c (visual_read) affects Wireshark 1.2.x < 1.2.17 and 1.4.x

CVE-2011-2175

Integer underflow in the visualread function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service application crash via a malformed Visual Networks file that triggers a heap-based buffer over-read...

CVE-2011-1213

Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that triggers a stack-based buffer overflow, aka SPR PRAD88MJ2W...

CVE-2011-1213

Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a crafted header in a .lzh attachment that triggers a stack-based buffer overflow, aka SPR PRAD88MJ2W...

CVE-2011-1213

In IBM Lotus Notes, the Autonomy KeyView component (lzhsr.dll) is vulnerable to a stack-based buffer overflow via a crafted .lzh header, caused by an integer underflow in KeyView’s parsing. A remote attacker could execute arbitrary code on affected systems running Lotus Notes before 8.5.2 FP3. Mi...

CVE-2011-0097

Integer underflow in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary cod...

CVE-2011-0097

Integer underflow in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary cod...

CVE-2011-0097

CVE-2011-0097 is a Microsoft Excel integer-overflow in the 400h substream parsing that can trigger a stack-based buffer overflow and remote code execution. Affected are Excel on Windows (2002 SP3/2003 SP3/2007 SP2/2010) and Mac variants, plus related File Format converters/viewers. The vulnerabil...

Design/Logic Flaw

Integer underflow in the BowserWriteErrorLogEntry function in the Common Internet File System CIFS browser service in Mrxsmb.sys or bowser.sys in Active Directory in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1...

CVE-2011-0654

CVE-2011-0654 describes an integer underflow in BowserWriteErrorLogEntry within the CIFS browser service (Mrxsmb.sys/bowser.sys) used by Active Directory; a malformed BROWSER ELECTION message can trigger a heap-based buffer overflow. Affected products include Windows XP SP2/SP3, Windows Server 20...

SuSE 11 Security Update : OpenOffice_org (SAT Patch Number 1258)

This update of OpenOffice.org fixes potential buffer overflow in EMF parser code enhwmf.cxx, emfplus.cxx Thanks to Petr Mladek. Additionally Secunia reported an integer underflow CVE-2009-0200 and a buffer overflow CVE-2009-0201 that could be triggered while parsing Word documents. Also provides...

CVE-2010-4529

Integer underflow in the irdagetsockopt function in net/irda/afirda.c in the Linux kernel before 2.6.37 on platforms other than x86 allows local users to obtain potentially sensitive information from kernel heap memory via an IRLMPENUMDEVICES getsockopt call...