Fedora 15 : libtiff-3.9.4-3.fc15 (2011-2498)

Fix buffer overrun in fax decoding CVE-2011-0192 as well as a non-security-critical crash in gif2tiff. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 14 : libtiff-3.9.4-3.fc14 (2011-2540)

Fix buffer overrun in fax decoding CVE-2011-0192 as well as a non-security-critical crash in gif2tiff. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Microsoft confirms Windows BROWSER protocol zero-day !

A security researcher has released proof-of-concept code for an unpatched security vulnerability affecting all versions of Windows, prompting a warning from Microsoft that remote code execution attacks are theoretically possible. Details on the vulnerability were released on the Full Disclosure...

Vulnerability in contrib module (CVE-2010-4015)

An authenticated database user can cause a buffer overrun by calling functions from the intarray optional module with certain parameters...

Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption PoC

!/usr/bin/python asmb-heap.py Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption PoC Jeremy Brown 0xjbrown41-gmail-com Jan 2011 A specially crafted length field in a MODBUS packet header can trigger heap corruption. 00408312 | 8B5424 3C MOV EDX,DWORD PTR SS:ESP+3C - move length into...

maradns -- denial of service when resolving a long DNS hostname

MaraDNS developer Sam Trenholme reports: ... a mistake in allocating an array of integers, allocating it in bytes instead of sizeofint units. This resulted in a buffer being too small, allowing it to be overwritten. The impact of this programming error is that MaraDNS can be crashed by sending...

SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 3760 / 3762 / 3763)

The SUSE Linux Enterprise 11 Service Pack 1 kernel was updated to 2.6.32.27 and fixes various bugs and security issues. The following security issues were fixed : - A local attacker could use a Oops kernel crash caused by other flaws to write a 0 byte to a attacker controlled address in the kerne...

SuSE 11.1 Security Update : libopenssl (SAT Patch Number 3539)

The following issue has been fixed : - Multithreaded OpenSSL servers using the TLS server extension were vulnerable to a buffer overrun attack. CVE-2010-3864 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Microsoft Graphics Filters CGM Image Converter Buffer Overrun (MS10-105; CVE-2010-3945; CVE-2012-2524)

Computer Graphics Metafile CGM is a free and open international standard file format for 2D vector graphics, raster graphics, and text. A remote code execution vulnerability has been discovered in the way that Microsoft Office allocates buffer size when handling CGM image files. The vulnerability...

SuSE 11 Security Update : (SAT Patch Number 2544)

This update of the Samba server package fixes the following security issues : - A buffer overrun was possible in chainreply code in 3.3.x and below, which could be used to crash the samba server or potentially execute code. CVE-2010-2063 - Take extra care that a mount point of mount.cifs does not...

SuSE 11 Security Update : libopenssl (SAT Patch Number 3509)

The following issue has been fixed : - Multithreaded OpenSSL servers using the TLS server extension were vulnerable to a buffer overrun attack. CVE-2010-3864 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Foxit PDF Reader v4.1.1 Title Stack Buffer Overflow

$Id: foxittitlebof.rb 11096 2010-11-22 17:43:42Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

DSA-2125-1 openssl - buffer overflow

Bulletin has no description...

FreeBSD : openssl -- TLS extension parsing race condition (3042c33a-f237-11df-9d02-0018fe623f2b)

OpenSSL Team reports : Rob Hulswit has found a flaw in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack. Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers tha...

Vulnerability in OpenSSL CVE-2010-3864

A flaw in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack. Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL’s internal caching mechanism. Servers that are multi-process and/or disable internal...

Immunity Canvas: FIREFOX_APPENDCHILD

Name| firefoxappendchild ---|--- CVE| CVE-2010-3765 Exploit Pack| CANVAS Description| firefoxappendchild Notes| CVE Name: CVE-2010-3765 VENDOR: Mozilla Notes: Interleaving document.write and appendChild can lead to duplicate text frames and overrunning of text run buffers. This exploit can only b...

SuSE 10 Security Update : Samba (ZYPP Patch Number 7072)

This update of the Samba server package fixes the following security issues : - A buffer overrun was possible in chainreply code in 3.3.x and below, which could be used to crash the samba server or potentially execute code. CVE-2010-2063 - Take extra care that a mount point of mount.cifs does not...

SuSE 10 Security Update : kdelibs3 (ZYPP Patch Number 6692)

KDE KDELibs Remote Array Overrun Arbitrary code execution, CVE-2009-0689 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49866; scriptversion"1.11";...

openssl -- TLS extension parsing race condition

OpenSSL Team reports: Rob Hulswit has found a flaw in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack. Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that...

Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (2)

$Id: adobeu3dmeshdecl.rb 10477 2010-09-25 11:59:02Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...