Two Remote Code Execution Vulnerabilities in Internet Explorer

Vulnerability 1: Internet Explorer Select Element Remote Code Execution Original advisory: http://ifsec.blogspot.com/2011/10/internet-explorer-select-element-remote.html I. OVERVIEW There is a vulnerability in Internet Explorer which enables execution of arbitrary code if the user visits a web pa...

CVE-2011-1996

Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Code Execution Vulnerability."...

Microsoft IE Option元素内存破坏漏洞(MS11-081)

BUGTRAQ ID: 49961 CVE ID: CVE-2011-1996 Microsoft Internet Explorer简称MSIE，是微软公司推出的一款网页浏览器。 IE在处理Option元素时在实现上存在内存破坏漏洞，当IE访问已删除对象时，远程攻击者可利用此漏洞远程代码或导致拒绝服务。 Microsoft Internet Explorer 9.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 6.x 临时解决方法：...

Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : apt vulnerabilities (USN-1215-1)

It was discovered that the apt-key utility incorrectly verified GPG keys when downloaded via the net-update option. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to install altered packages. This update corrects the issue by disabling th...

GeoClassifieds Lite Multiple Vulnerabilities (Sep 2011) - Active Check

GeoClassifieds Lite is prone to multiple SQL injection SQLi and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

View PDF Macro in Office Connector makes http fetch from Adobe from https session

The View PDF macro within the Office Connector plugin provides the following http URL even for https sessions when a user's browser fails the Flash installed test. http://www.adobe.com/images/shared/downloadbuttons/getflashplayer.gif It's bad form to mix http urls in with secured https sessions a...

DEBIAN-CVE-2011-0543

Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack...

Joomla Component mod_spo SQL Injection Vulnerability

No description provided by source. Exploit Title: Simple Page Option LFI Google Dork: inurl:modspo Date: 15/07/2011 Author: SeguridadBlanca.Blogspot.com or SeguridadBlanca Software Link: http://joomlacode.org/gf/download/frsrelease/11841/47776/modspo1.5.16.zip Version: 1.5.x Tested on: Backtrack...

Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : logrotate vulnerabilities (USN-1172-1)

It was discovered that logrotate incorrectly handled the creation of new log files. Local users could possibly read log files if they were opened before permissions were in place. This issue only affected Ubuntu 8.04 LTS. CVE-2011-1098 It was discovered that logrotate incorrectly handled certain...

rsync excluded content access restrictions bypass via symlinks

Unspecified vulnerability in rsync before 3.0.0pre6, when running a writable rsync daemon, allows remote attackers to bypass exclude, excludefrom, and filter and read or write hidden files via 1 symlink, 2 partial-dir, 3 backup-dir, and unspecified 4 dest options...

Joomla Component mod_spo SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Simple Page Option LFI Google Dork: inurl:modspo Date: 15/07/2011 Author: SeguridadBlanca.Blogspot.com or SeguridadBlanca Software Link: http://joomlacode.org/gf/download/frsrelease/11841/47776/modspo1.5.16.zip Version: 1.5.x...

Joomla Simple Page Option Local File Inclusion

Simple Page Option – LFI Vulnerable-Code: $slang =& JRequest::getVar'spositelang'; fileexistsdirnameFILE.DS.'languages'.DS.$slang.'.php' ? includedirnameFILE.DS.'languages'.DS.$slang.'.php' : includedirnameFILE.DS.'languages'.DS.'english.php'; Vulnerable-Var: spositelang= Expl0iting:...

system-config-firewall security update

system-config-firewall: 1.2.27-3.3 - fixed possible privilege escalation flaw via use of python pickle CVE-2011-2520, replaced pickle by json rhbz717985 - stop D-BUS firewall mechanism on update system-config-printer: 1.1.16-17:.2 - Build pycups with -fno-strict-aliasing compiler option to avoid...

CVE-2011-2536

chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending o...

CVE-2011-2535

chaniax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a deni...

CVE-2011-2666

CVE-2011-2666 affects Asterisk Open Source SIP channel, where the default configuration does not enable the alwaysauthreject option in the SIP channel driver. This allows remote attackers to enumerate account names by sending a series of invalid SIP requests and observing differences in responses...

CVE-2009-5078

contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document...

DEBIAN-CVE-2009-5078

contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document...

CVE-2009-5078

contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document...

(mod_dav_svn): DoS (excessive memory use) when configured to provide path-based access control

The moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz shortcircuit option is enabled, allows remote attackers to cause a denial of service infinite loop and memory consumption in opportunistic circumstances by...