CVE-2006-7095

Integer signedness error in the networkreceivepacket function in socket.c in dimension 3 engine dim3 1.5 and earlier allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a large datalen value, which is cast to a signed short and results in...

CVE-2006-7095: Undefined Security Weakness

Integer signedness error in the networkreceivepacket function in socket.c in dimension 3 engine dim3 1.5 and earlier allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a large datalen value, which is cast to a signed short and results in...

CVE-2006-6013

Integer signedness error in the fwioctl FWIOCTL function in the FireWire IEEE-1394 drivers dev/firewire/fwdev.c in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows...

CVE-2006-6013

The CVE-2006-6013 issue affects the FireWire (IEEE-1394) driver fwdev.c in several BSDs, where in the FW_GCROM ioctl a signed integer comparison is used to compute the length of a buffer copied from kernel memory, effectively enabling a local user to read arbitrary kernel memory contents when cro...

CVE-2006-6013

Integer signedness error in the fwioctl FWIOCTL function in the FireWire IEEE-1394 drivers dev/firewire/fwdev.c in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows...

CVE-2006-6013: Undefined Security Weakness

Integer signedness error in the fwioctl FWIOCTL function in the FireWire IEEE-1394 drivers dev/firewire/fwdev.c in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows...

CVE-2006-4516: Undefined Security Weakness

Integer signedness error in FreeBSD 6.0-RELEASE allows local users to cause a denial of service memory corruption and kernel panic via a PTLWPINFO ptrace command with a large negative data value that satisfies a signed maximum value check but is used in an unsigned copyout function call...

CVE-2006-4516

CVE-2006-4516 affects FreeBSD 6.0-RELEASE. The kernel’s PT_LWPINFO ptrace handling has a signedness flaw: a large negative data value can bypass the signed check and be passed to copyout, causing memory corruption and kernel panic. Impact is a local denial-of-service condition. Described in iDefe...

CVE-2006-4516

Integer signedness error in FreeBSD 6.0-RELEASE allows local users to cause a denial of service memory corruption and kernel panic via a PTLWPINFO ptrace command with a large negative data value that satisfies a signed maximum value check but is used in an unsigned copyout function call...

CVE-2006-4178

Integer signedness error in the i386setldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service crash via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter, a...

CVE-2006-4178

Integer signedness error in the i386setldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service crash via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter, a...

CVE-2006-4178

CVE-2006-4178 is a local denial-of-service vulnerability in FreeBSD’s i386_set_ldt implementation. The issue arises from signedness in the i386_ldt handling: user-controlled start and num are added into a signed i, and if i becomes negative, bzero is invoked with a very large length, allowing a k...

CVE-2006-4178: Undefined Security Weakness

Integer signedness error in the i386setldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service crash via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter, a...

Solaris 10 sysinfo(2) Local Kernel Memory Disclosure Exploit

Exploit for solaris platform in category local exploits ============================================================ Solaris 10 sysinfo2 Local Kernel Memory Disclosure Exploit ============================================================ / $Id: raptorsysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp ...

Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2)

Solaris 10 sysinfo2 - Local Kernel Memory Disclosure 2 / $Id: raptorsysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp $ raptorsysinfo.c - Solaris sysinfo2 kernel memory leak Copyright c 2006 Marco Ivaldi systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count...

CVE-2006-3824

systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness...

CVE-2006-3824

CVE-2006-3824 : Solaris sysinfo(2) local kernel memory disclosure. Local users can read kernel memory when a 0-variable-count argument is passed to sysinfo, causing a -1 argument to be used by copyout. This is described as an integer overflow/signedness issue. Public exploit evidence exists (Sola...

Opera: Buffer overflow

Background Opera is a multi-platform web browser. Description SEC Consult has discovered a buffer overflow in the code processing style sheet attributes. It is caused by an integer signedness error in a length check followed by a call to a string function. It seems to be hard to exploit this buff...

DSA-1048-1 asterisk - several vulnerabilities

Bulletin has no description...

CVE-2006-1834

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings...