Mozilla Firefox PKCS11 Module Installation Code Execution

Added: 09/24/2009 CVE: CVE-2009-3076 BID: 36343 OSVDB: 57977 Background Mozilla is a suite of Internet client products available for multiple platforms. Problem The warning dialog displayed when adding or removing security modules via pkcs11.addmodule or pkcs11.deletemodule can be customized by a...

CVE-2009-2813

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote...

DEBIAN-CVE-2009-2813

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote...

CVE-2009-2813

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote...

aMule: Parameter injection

Background aMule is an eMule-like client for the eD2k and Kademlia networks, supporting multiple platforms. Description Sam Hocevar discovered that the aMule preview function does not properly sanitize file names. Impact A remote attacker could entice a user to download a file with a specially...

VMSA-2009-0012 VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2009-0012 Synopsis: VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues. Issue date:...

Low: Red Hat Security Advisory: lftp security and bug fix update

An updated lftp package that fixes one security issue and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. LFTP is a sophisticated file transfer program for the FTP and HTTP protocols. Lik...

Mandriva Linux Security Advisory : libneon0.27 (MDVSA-2009:221)

Multiple vulnerabilities has been found and corrected in libneon0.27 : neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document...

Subversion: Remote execution of arbitrary code

Background Subversion is a versioning system designed to be a replacement for CVS. Description Matt Lewis of Google reported multiple integer overflows in the libsvndelta library, possibly leading to heap-based buffer overflows. Impact A remote attacker with commit access could exploit this...

Microsoft Windows WINS Service Heap Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WINS.exe process which provides name resolution services for NetBIOS networks...

Adobe products: Multiple vulnerabilities

Background Adobe Flash Player is a closed-source playback software for Flash SWF files. Adobe Reader is a closed-source PDF reader that plays Flash content as well. Description Multiple vulnerabilities have been reported in Adobe Flash Player: lakehu of Tencent Security Center reported an...

kernel security update

CentOS Errata and Security Advisory CESA-2009:1193 Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages...

Syslog-ng: Chroot escape

Background Syslog-ng is a flexible and scalable system logger. Description Florian Grandel reported that Syslog-ng does not call chdir before chroot which leads to an inherited file descriptor to the current working directory. Impact A local attacker might exploit a separate vulnerability in...

Atlantic SimpleCaddy Shopping Cart Price Manipulation

SENKED-2009-0001 - Atlantic SimpleCaddy Shopping Cart Price Manipulation senked security advisory http://www.senked.com/ Date Published: 2009-07-01 Last Update: 2009-07-01 Advisory ID: SENKED-2009-0001 Bugtraq ID: none CVE Name: none Title: Atlanticintelligence SimpleCaddy Shoopuing Cart Price...

DNS Name Resolution

Binary data 7013.pasl...

Wireshark: Multiple vulnerabilities

Background Wireshark is a versatile network protocol analyzer. Description Multiple vulnerabilities have been discovered in Wireshark: David Maciejak discovered a vulnerability in packet-usb.c in the USB dissector via a malformed USB Request Block URB CVE-2008-4680. Florent Drouin and David...

CVE-2009-2187

Multiple memory leaks in the 1 IP and 2 IPv6 multicast implementation in the kernel in Sun Solaris 10, and OpenSolaris snv67 through snv93, allow local users to cause a denial of service memory consumption via vectors related to the association of a DLENABMULTIREQ and b DLDISABMULTIREQ messages...

tor-devel -- DNS resolution vulnerability

The Tor Project reports: A malicious exit relay could convince a controller that the client's DNS question resolves to an internal IP address...

Pidgin: Multiple vulnerabilities

Background Pidgin formerly Gaim is an instant messaging client for a variety of instant messaging protocols. Description Multiple vulnerabilities have been discovered in Pidgin: Veracode reported a boundary error in the "XMPP SOCKS5 bytestream server" when initiating an outgoing file transfer...

Eggdrop/Windrop 1.6.19 ctcpbuf Remote Crash Vulnerability

No description provided by source. eggdrop/windrop remote crash vulnerability This message: Message body More options Related messages: Next message Previous message Next in thread Replies From: Thomas Sader thommeyatgmail.com Date: Fri, 15 May 2009 05:54:08 +0200 Affected software...