Zortam MP3 Media Studio 9.40 Multiple Memory Corruption Vulnerabilities

Summary Zortam Mp3 Media Studio is all-in-one Mp3 application that contains Mp3 ID3 Tag Organizer for searching and cataloguing Mp3 files into Mp3 library, editing ID3v1 and ID3v2.4 tags ID3 Tag Editor-Mp3 Tag Editor, CD Ripper with album cover art/lyric support that uses CDDB Internet Compact Di...

Zortam MP3 Media Studio 9.40 - Multiple Memory Corruption Vulnerabilities

Zortam MP3 Media Studio 9.40 - Multiple Memory Corruption Vulnerabilities !/usr/bin/perl Title: Zortam MP3 Media Studio 9.40 Multiple Memory Corruption Vulnerabilities Product web page: http://www.zortam.com Desc: Zortam MP3 Studio version 9.40 suffers from a memory corruption attack from two...

Unfixed XSS vulnerability at www.safety-lab.com

Security researcher Rohit Bansal, has submitted on 07/11/2009 a cross-site-scripting XSS vulnerability affecting www.safety-lab.com, which at the time of submission ranked 1041608 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/07/2010. It i...

ruby

New ruby packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-1904 Here are the details from the Slackware 12.2...

AIMP 2.51 build 330 (ID3v1/ID3v2 Tag) Remote Stack Buffer Overflow PoC (SEH)

Summary Freeware audio player. Description AIMP version 2.51 build 330 suffers from a stack based buffer overflow vulnerability that can be exploited via malicious media file that supports ID3 tags mp3. EIP and ECX registers gets overwritten, including the SE handler and the pointer to the next S...

pidgin

New pidgin packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-1373 https://vulners.com/cve/CVE-2009-1374...

ViPlay3 <= 3.00 (.vpl) Local Stack Overflow PoC

Summary ViPlay3 is a freeware movie player designed to play the most popular movie types using overlaying technology for a faster and more efficient way of video playback. Description URUWorks ViPlay3 is prone to a remote buffer-overflow vulnerability because the application fails to perform...

mozilla-firefox

New mozilla-firefox packages are available for Slackware 12.2 and -current to fix security issues. The updated packages may also be used with Slackware 11.0 or newer. More details about the issues may be found on the Mozilla website:...

Porn dialers for smartphones

Security researchers at Kaspersky Lab our corporate sponsor are warning about a new potentially unwanted program viruslist.com targeting Symbian-based smart phones. The program, called iPornPlayer screenshot at right, promises sexually-explicit content on handsets but there’s a hefty price attach...

QtWeb Internet Browser 2.0 (build 043) Remote Denial of Service Exploit (smile)

Summary QtWeb is compact, portable and secure web browser having some unique UI and privacy features. QtWeb is an open source project based on Nokia's Qt framework former Trolltech and Apple's WebKit rendering engine the same as being used in Apple Safari and Google Chrome. Description QtWeb...

PowerCHM 5.7 (hhp) Local Buffer Overflow Exploit

Summary With PowerCHM you can create your CHM files automatically from Html Files including .htm, .html and .mht, Text Files .txt, Microsoft Word Documents .doc and Adobe Acrobat Document .pdf. Description The vulnerability is caused due to a boundary error when processing overly long filenames...

HTC Touch - vCard over IP Denial of Service

!/usr/bin/env python Copyright c 2009 Mobile Security Lab www.mseclab.com Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files the "Software", to deal in the Software without restriction, including without limitation the...

HTC Touch vCard over IP Denial of Service PoC Code

Hello, PoC code for testing the MSL-2008-002 vulnerability HTC Touch vCard over IP Denial of Service is now available at: http://poc.mseclab.com/pocs/MSL-2008-002-PoC.py The code provide means for demonstrating the HTC Touch vCard over IP DoS by sending vCards to port UDP/9204 of the target IP...

Multiple Kaspersky Lab applications privilege escalation

Access to kernel memory regions from usermode on IOCTL processing...

Amaya Web Editor 11 Remote SEH Overwrite Exploit

Summary Amaya is a Web editor, i.e. a tool used to create and update documents directly on the Web. Description Amaya Web Editor is prone to a buffer overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input. Attackers may leverage these issue...

SonyEricsson WAP Push Denial of Service

Security Advisory MSL-2008-001 - SonyEricsson WAP Push Denial of Service Advisory Information -------------------- Title: SonyEricsson WAP Push Denial of Service Advisory ID: MSL-2008-001 Advisory URL: http://www.mseclab.com/index.php?pageid=123 Published: 2009-01-26 Updated: 2009-01-26 Vendor:...

WFTPD Pro Server 3.30.0.1 (pre auth) Multiple Remote Denial of Service Vulnerabilities

Summary Professional FTP server for Windows NT / 2000 / XP / 2003. Description WFTPD Pro Server 3.30.0.1 suffers from multiple remote vulnerabilities which resolves in denial of service. Several commands are vulnerable including: LIST, MLST, NLST, NLST -al, STAT and maybe more. This issue is...

Microsoft SQL Server fails to properly validate parameters to the sp_replwritetovarbin extended stored procedure

Overview A vulnerability in the Microsoft SQL Server spreplwritetovarbin extended stored procedure could allow an authenticated attacker to execute arbitrary code on an affected server. Description Some versions of Microsoft SQL Server contain a vulnerability in the spreplwritetovarbin stored...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. More details about the issues may be found on the Mozilla website: http://www.mozilla.org/security/known-vulnerabilities/firefox20.html...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues. More details about the issues may be found on the Mozilla site: http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.html Here are the details from the Slackwar...