CVE-2006-4178

Integer signedness error in the i386setldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service crash via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter, a...

Solaris 10 sysinfo(2) Local Kernel Memory Disclosure Exploit

Exploit for solaris platform in category local exploits ============================================================ Solaris 10 sysinfo2 Local Kernel Memory Disclosure Exploit ============================================================ / $Id: raptorsysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp ...

Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2)

Solaris 10 sysinfo2 - Local Kernel Memory Disclosure 2 / $Id: raptorsysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp $ raptorsysinfo.c - Solaris sysinfo2 kernel memory leak Copyright c 2006 Marco Ivaldi systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count...

CVE-2006-3824

systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness...

CVE-2006-3824

CVE-2006-3824 : Solaris sysinfo(2) local kernel memory disclosure. Local users can read kernel memory when a 0-variable-count argument is passed to sysinfo, causing a -1 argument to be used by copyout. This is described as an integer overflow/signedness issue. Public exploit evidence exists (Sola...

Opera: Buffer overflow

Background Opera is a multi-platform web browser. Description SEC Consult has discovered a buffer overflow in the code processing style sheet attributes. It is caused by an integer signedness error in a length check followed by a call to a string function. It seems to be hard to exploit this buff...

DSA-1048-1 asterisk - several vulnerabilities

Bulletin has no description...

CVE-2006-1834

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings...

CVE-2006-1834

Opera before 8.54 is affected by a vulnerability caused by an integer signedness error in the handling of long values in a stylesheet attribute, which can bypass a length check and potentially allow remote code execution. This is documented in multiple sources associated with CVE-2006-1834, inclu...

CVE-2006-1834

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. NOTE: a sign extension problem makes the attack easier with shorter strings...

Integer overflow

Integer signedness error in formatjpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length...

CVE-2006-1827

Integer signedness error in formatjpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length...

CVE-2006-1827

Integer signedness error in formatjpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length...

CVE-2006-1827

Vulnerability: Asterisk

CVE-2006-1827

Integer signedness error in formatjpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length...

CVE-2006-1827

Integer signedness error in formatjpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length...

[Full-disclosure] SEC Consult SA-20060314 :: Opera Browser CSS Attribute Integer Wrap / Buffer Overflow

SEC-CONSULT Security Advisory 20060413-0 ======================================== title: Opera Browser CSS Attribute Integer Wrap / Buffer Overflow program: Opera vulnerable version: = 8.52 homepage: www.opera.com found: 2006-03-01 by: SEC Consult / www.sec-consult.com...

CVE-2006-1194

Integer signedness error in the enetprotocolhandleincomingcommands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including 1 Cube, 2 Sauerbraten, and 3 Duke3dw32, allows remote attackers to cause a denial of service application crash via a packet wi...

CVE-2006-1194

The CVE-2006-1194 entry concerns an integer signedness error in the ENet library’s enet_protocol_handle_incoming_commands (protocol.c) affecting CVS-version Jul 2005 and earlier. It is used by products including Cube, Sauerbraten, and Duke3d_w32. The flaw allows a remote attacker to cause an appl...

CVE-2006-1194

Integer signedness error in the enetprotocolhandleincomingcommands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including 1 Cube, 2 Sauerbraten, and 3 Duke3dw32, allows remote attackers to cause a denial of service application crash via a packet wi...