CVE-2007-5029

Dibbler 0.6.0 does not verify that certain length parameters are appropriate for buffer sizes, which allows remote attackers to trigger a buffer over-read and cause a denial of service daemon crash, as demonstrated by incorrect behavior of the TSrvMsg constructor in SrvMessages/SrvMsg.cpp when 1...

CVE-2007-5031

The TSrvOptIANA::rebind method in SrvOptions/SrvOptIANA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service NULL dereference and daemon crash via an invalid IANA option in a REBIND message...

DEBIAN-CVE-2007-5031

The TSrvOptIANA::rebind method in SrvOptions/SrvOptIANA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service NULL dereference and daemon crash via an invalid IANA option in a REBIND message...

Information disclosure

Unspecified vulnerability in Adobe Acrobat and Reader 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted PDF file, related to the mailto: option and Internet Explorer 7 on Windows XP. NOTE: this information is based upon a vague pre-advisory by a reliable researcher...

CVE-2007-5031

The TSrvOptIANA::rebind method in SrvOptions/SrvOptIANA.cpp in Dibbler 0.6.0 allows remote attackers to cause a denial of service NULL dereference and daemon crash via an invalid IANA option in a REBIND message...

airsensor-dos.txt

!/usr/bin/perl -w Airsensor M520 HTTPD Remote Preauth Denial Of Service and Buffer Overflow PoC The vulnerability is caused due to an unspecified error in the cgis files filter used for configure propierties. This can be exploited by sending a specially crafted HTTPS request necessary...

CVE-2007-0004

The NFS client implementation in the kernel in Red Hat Enterprise Linux RHEL 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfspermission mode bits data rather than an NFS ACCESS call to the server, which allows local client processes to...

CVE-2007-4138

The Winbind nssinfo extension nsswitch/idmapad.c in idmapad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the 1 RFC2307 or 2 Services for UNIX SFU primary group attribute is not defined...

Moderate: kernel security and bugfix update

2.6.9-55.0.6.0.1 - fix entropy flag in bnx2 driver to generate entropy pool John Sobecki orabug 5931647 - fix for nfs open call taking longer issue Chuck Lever orabug 5580407 bz 219412 - fix enomem due to larger mtu size page alloc Zach Brown orabug 5486128 - fix percpu api bugon with rds Zach...

Cross site scripting

Cross-site scripting XSS vulnerability in Ipswitch WSFTP allows remote attackers to inject arbitrary web script or HTML via arguments to a valid command, which is not properly handled when it is displayed by the view log option in the administration interface. NOTE: this can be leveraged to creat...

CVE-2007-3843

The Linux kernel before 2.6.23-rc1 checks the wrong global variable for the CIFS sec mount option, which might allow remote attackers to spoof CIFS network traffic that the client configured for security signatures, as demonstrated by lack of signing despite sec=ntlmv2i in a SetupAndX request...

Joomla Component Expose <= RC35 Remote File Upload Vulnerability

Exploit for unknown platform in category web applications ================================================================ Joomla Component Expose $targetpath = "../../../components/comexpose/expose/img/"; ++ ++ ifstrcasecmpsubstr$userfilename,-4,'.jpg' echo "alert'The file must be jpg';";++ ++...

Important: kernel security and bug fix update

2.6.18-8.1.6.0.1.el5 -Fix bonding primary=ethX so it picks correct network Bert Barbe IT 101532 ORA 5136660 -Add entropy module option to e1000 John Sobecki ORA 6045759 -Add entropy module option to bnx2 John Sobecki ORA 6045759 2.6.18.8-1.6.el5 - bluetooth close information leaks in setsockopt...

CVE-2007-2796

Arris Cadant C3 CMTS allows remote attackers to cause a denial of service service termination via a malformed IP packet with an invalid IP option...

Code injection

Arris Cadant C3 CMTS allows remote attackers to cause a denial of service service termination via a malformed IP packet with an invalid IP option...

Design/Logic Flaw

IPSecDrv.sys 10.4.0.12 in SafeNET High Assurance Remote 1.4.0 Build 12, and SoftRemote, allows remote attackers to cause a denial of service infinite loop and system hang via an invalid packet with certain bytes in an option header, possibly related to the IPv6 support for IPSec...

CVE-2007-3157

IPSecDrv.sys 10.4.0.12 in SafeNET High Assurance Remote 1.4.0 Build 12, and SoftRemote, allows remote attackers to cause a denial of service infinite loop and system hang via an invalid packet with certain bytes in an option header, possibly related to the IPv6 support for IPSec...

Fixed in Apache Tomcat JK Connector 1.2.23

Important: Information disclosure CVE-2007-1860 The issue is related to CVE-2007-0450, the patch for which was insufficient. When multiple components firewalls, caches, proxies and Tomcat process a request, the request URL should not get decoded multiple times in an iterative way by these...

SOL4743 - Inadequate validation for TCP segments CVE-2005-0356

Multiple TCP implementations with Protection Against Wrapped Sequence Numbers PAWS with the timestamps option enabled allow remote attackers to cause a denial of service connection loss via a spoofed packet with a large timer value, which causes the host to discard later packets because they appe...

samba heap overflows

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving 1 DFSEnum netdfsiodfsEnumInfod, 2 RFNPCNEX smbionotifyoptiontypedata, 3 LsarAddPrivilegesToAccount...