4207 matches found
libxpm buffer overflow
scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmapunit value that leads to a buffer overflow...
CVE-2005-0482
TrackerCam 5.12 and earlier allows remote attackers to cause a denial of service crash via 1 a large number of connections with a negative Content-Length header, possibly triggering an integer signedness error, or 2 a large amount of data...
security flaw
Multiple integer signedness errors in the sgscsiioctl function in scsiioctl.c for Linux 2.6.x allow local users to read or modify kernel memory via negative integers in arguments to the scsi ioctl, which bypass a maximum length check before calling the copyfromuser and copytouser functions...
DEBIAN-CVE-2004-0918
The asnparseheader function asn1.c in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service server restart via certain SNMP packets with negative length fields that trigger a memory allocation error...
USN-66-1: PHP vulnerabilities
FraMe from kernelpanik.org reported that the cURL module does not respect openbasedir restrictions. As a result, scripts which used cURL to open files with an user-specified path could read arbitrary local files outside of the openbasedir directory. Stefano Di Paola discovered a vulnerability in...
security flaw
Integer overflow in 1 tifdirread.c and 2 tiffax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFFASCII or TIFFUNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow...
CVE-2004-2592
Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service application crash via a modified client that asks the server to send data stored at a negative array offset, which is not handled when processing Configstrings and Baselines...
security flaw
The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow"...
security flaw
Integer overflow in the ubseckeysetup function for Linux Broadcom 5820 cryptonet driver allows local users to cause a denial of service crash and possibly execute arbitrary code via a negative adddsabufbytes variable, which leads to a buffer overflow...
CVE-2004-0832
The 1 ntlmfetchstring and 2 ntlmgetstring functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service application crash via an NTLMSSP packet that causes a negative value to be passed to memcpy...
Squid SNMP DoS
The asnparseheader function asn1.c in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service server restart via certain SNMP packets with negative length fields that trigger a memory allocation error...
FreeBSD syscons integer overflow
CONSSCRSHOT ioctl for syscons invalidely handles negative values...
Debian DSA-144-1 : wwwoffle - improper input handling
A problem with wwwoffle has been discovered. The web proxy didn't handle input data with negative Content-Length settings properly which causes the processing child to crash. It is at this time not obvious how this can lead to an exploitable vulnerability; however, it's better to be safe than...
Debian DSA-232-1 : cupsys - several vulnerabilities
Multiple vulnerabilities were discovered in the Common Unix Printing System CUPS. Several of these issues represent the potential for a remote compromise or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2002-1383: Multiple integer...
CVE-2003-0075
Integer signedness error in the myFseek function of samplein.c for Blade encoder BladeEnc 0.94.2 and earlier allows remote attackers to execute arbitrary code via a negative offset value following a "fmt" wave chunk...
Mandrake Linux Security Advisory : cups (MDKSA-2003:001)
iDefense reported several security problems in CUPS that can lead to local and remote root compromise. An integer overflow in the HTTP interface can be used to gain remote access with CUPS privilege. A local file race condition can be used to gain root privilege, although the previous bug must be...
FreeBSD : bind8 negative cache poison attack (17)
The following package needs to be updated: bind %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkgf04cc5cb2d0b11d8beaf000a95c4d922.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-200...
Monit fails to properly handle negative Content-Length fields
Overview Monit fails to properly handle HTTP requests containing a negative Content-Length field. Description Monit is a utility to monitor system processes, files, directories, devices, and remote hosts. It provides a web-based interface that can be used to access the Monit server. When processi...
Ethereal integer underflow when parsing malformed PGM packets with NAK lists
Overview Ethereal fails to properly parse Pragmatic General Multicast PGM packets containing a crafted negative acknowledgement NAK list. Description Ethereal is a network traffic analysis package. It includes the ability to decode packets containing PGM data. There is a vulnerability in the way...
CVE-2004-0321
CVE-2004-0321 affects Team Factor 1.25 and earlier. A remote attacker can crash the service by sending a packet where the data block size is a negative number, causing Team Factor to read unallocated memory and trigger a denial of service. The available descriptions consistently state this issue ...