Apple QuickTime TeXML Color String Parsing Buffer Overflow (CVE-2012-0663)

A stack buffer overflow vulnerability has been reported in Apple QuickTime. The vulnerability is due to insufficient validation of a string length when processing certain elements inside QuickTime TeXML files. A remote attacker can exploit this issue by enticing a target user to open a specially...

kernel: macvtap: zerocopy: vector length is not validated before pinning user pages

Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service crash via a long descriptor with a long vector length...

DEBIAN-CVE-2012-1182

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call...

samba: Multiple heap-based buffer overflows in memory management based on NDR marshalling code output

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call...

samba: Multiple heap-based buffer overflows in memory management based on NDR marshalling code output

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call...

Interactive Data eSignal Stack Buffer Overflow (CVE-2011-3494)

A stack buffer overflow vulnerability exists in Interactive Data eSignal. The vulnerability is due to insufficient string length validation when copying input into a fixed size stack buffer in certain file types.A remote attacker may exploit this issue by enticing a target user to open a speciall...

SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow (CVE-2007-5603)

An arbitrary code execution vulnerability has been reported in SonicWall SSL-VPN NetExtender. The vulnerability is due to insufficient length validation by an ActiveX control. A remote attacker may exploit this vulnerability by sending a specially crafted request to an affected service. Successfu...

PT-2011-4187 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.1-rc3 Description: The issue is related to the befs follow link function in fs/befs/linuxvfs.c, which does not validate the length attribute of long symlinks. This allows local users to cause a denial of servi...

kernel: drivers/scsi/mpt2sas: prevent heap overflows

drivers/scsi/mpt2sas/mpt2sasctl.c in the Linux kernel 2.6.38 and earlier does not validate 1 length and 2 offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service memory corruption, or obtain sensitive information from...

Microsoft Windows LSASS Length Validation Privilege Escalation (MS11-014; CVE-2011-0039)

The Local Security Authority Subsystem Service LSASS provides an interface for managing local security, domain authentication, and Active Directory service processes. It handles authentication for the client and for the server. An elevation of privilege vulnerability has been reported in the way...

Windows NT NNTP Component Buffer Overflow

The Network News Transfer Protocol NNTP component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an...

Windows NT NNTP Component Buffer Overflow

The Network News Transfer Protocol NNTP component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an...

Oracle Database 10.1.0.5 - 10.2.0.4 AUTH_SESSKEY length validation

Exploit for unknown platform in category remote exploits ========================================================================== Oracle Database 10.1.0.5 - 10.2.0.4 AUTHSESSKEY length validation exploit ========================================================================== Title: Oracle...

Oracle Database 10.1.0.5 - 10.2.0.4 AUTH_SESSKEY length validation exploit

No description provided by source. include winsock2.h include stdio.h include string.h include windows.h include assert.h include string void ssend SOCKET s, char msg, DWORD size int sent; printf "ssend: begin: %d bytes\n", size; sent=send s, charmsg, size, 0; if sent==SOCKETERROR printf "send -...

Fedora 10 : krb5-1.6.3-18.fc10 (2009-2852)

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism CVE-2009-0844, CVE-2009-0845, attempts to free an uninitialized pointer during protocol parsing CVE-2009-0846, and a bug in length validation during...

Fedora Core 10 FEDORA-2009-2852 (krb5)

The remote host is missing an update to krb5 announced via advisory FEDORA-2009-2852. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora Core 9 FEDORA-2009-2834 (krb5)

The remote host is missing an update to krb5 announced via advisory FEDORA-2009-2834. OpenVAS Vulnerability Test $Id: fcore20092834.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-2834 krb5 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Fedora 9 : krb5-1.6.3-16.fc9 (2009-2834)

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism CVE-2009-0844, CVE-2009-0845, attempts to free an uninitialized pointer during protocol parsing CVE-2009-0846, and a bug in length validation during...

krb5 security update

1.3.4-60.el47.2 - whoops, actually add the patches 1.3.4-60.el47.1 - add fix for attempt to free uninitialized pointer in the ASN.1 decoder 491835, CVE-2009-0846 - add fix for bug in length validation in the ASN.1 decoder CVE-2009-0847...

evolution-data-server: insufficient checking of NTLM authentication challenge packets

The ntlmchallenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server aka evolution-data-server 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount o...