Mozilla: Potential XSS via multibyte content processing errors (MFSA 2012-24)

Cross-site scripting XSS vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set...

Mozilla: Potential XSS via multibyte content processing errors (MFSA 2012-24)

Cross-site scripting XSS vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set...

DSA-2458-1 iceape - several

Bulletin has no description...

DSA-2457-1 iceweasel - several

Bulletin has no description...

Potential XSS via multibyte content processing errors — Mozilla

Anne van Kesteren of Opera Software found a multi-octet encoding issue where certain octets will destroy the following octets in the processing of some multibyte character sets. This can leave users vulnerable to cross-site scripting XSS attacks on maliciously crafted web pages...

CentOS Update for thunderbird CESA-2011:1438 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

seamonkey security update

CentOS Errata and Security Advisory CESA-2011:1440 Updated seamonkey packages that fix one security issue are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base...

Moderate: Red Hat Security Advisory: seamonkey security update

Updated seamonkey packages that fix one security issue are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Mozilla: Universal XSS likely with MultiByte charset (MFSA 2011-47)

Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding...

Moderate: Red Hat Security Advisory: thunderbird security update

An updated thunderbird package that fixes one security issue is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Mod_auth_mysql Multibyte Encoding SQL Injection

There is a SQL injection vulnerability in this installation of modauthmysql that may allow an attacker access to restricted areas of a website. Successful attacks have only been demonstrated against sites with AuthMySQLCharacterSet set to big5, gbk, and sjis but other encodings may be affected...

Fedora 13 : mod_auth_mysql-3.0.0-12.fc13 (2011-0114)

This update fixes a security issue in modauthmysql. A flaw was found in the way modauthmysql escaped certain multibyte-encoded strings. If modauthmysql was configured to use a multibyte character set that allowed a backslash '' as part of the character encodings, a remote attacker could inject...

RHEL 6 : mod_auth_mysql (RHSA-2010:1002)

An updated modauthmysql package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

mod_auth_mysql: character encoding SQL injection flaw

SQL injection vulnerability in modauthmysql.c in the mod-auth-mysql aka libapache2-mod-auth-mysql module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ backslash as part of the character encoding, allows remote attackers to execute arbitrary SQL...

Debian DSA-1910-1 : mysql-ocaml - missing escape function

It was discovered that mysql-ocaml, OCaml bindings for MySql, was missing a function to call mysqlrealescapestring. This is needed, because mysqlrealescapestring honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The adde...

Debian DSA-1909-1 : postgresql-ocaml - missing escape function

It was discovered that postgresql-ocaml, OCaml bindings to PostgreSQL's libpq, was missing a function to call PQescapeStringConn. This is needed, because PQescapeStringConn honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are use...

Debian DSA-1889-1 : icu - programming error

It was discovered that the ICU unicode library performed incorrect processing of invalid multibyte sequences, resulting in potential bypass of security mechanisms. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debia...

php: htmlspecialchars() insufficient checking of input for multi-byte encodings

The htmlspecialchars function in PHP before 5.2.12 does not properly handle 1 overlong UTF-8 sequences, 2 invalid ShiftJIS sequences, and 3 invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting XSS attacks by placing a crafted byte sequence before a special...

Mandriva Security Advisory MDVSA-2009:189-1 (apache-mod_auth_mysql)

The remote host is missing an update to apache-modauthmysql announced via advisory MDVSA-2009:189-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

PHP 'htmlspecialcharacters()'畸形多字节字符跨站脚本漏洞

Bugraq ID: 37389 CVE ID：CVE-2009-4142 PHP是一款流行的网络编程语言。 htmlspecialchars函数不严格检查多字节序列，远程攻击者可以利用漏洞进行跨站脚本攻击。 PHP PHP 5.2.11 PHP PHP 5.2.10 PHP PHP 5.2.9 PHP PHP 5.2.8 PHP PHP 5.2.7 PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4 PHP PHP 5.2.3 PHP PHP 5.2.2 PHP PHP 5.2.1 PHP PHP 5.2 PHP...