DEBIAN-CVE-2017-1000254

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in anonymous or not, it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double...

nodejs-qs: Prototype override protection bypass

It was found that ljharb's qs module for Node.js did not properly parse query strings. An attacker could send a specially crafted query that overwrites the resulting object's prototype properties such as toString or hasOwnProperty, resulting in a denial of service when the overwritten function...

DLA-757-1 phpmyadmin - security update

Bulletin has no description...

CVE-2016-9865

An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMAsafeUnserialize function. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-9865

An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMAsafeUnserialize function. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

Design/Logic Flaw

An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMAsafeUnserialize function. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-9865

An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMAsafeUnserialize function. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

Updated phpmyadmin packages fix security vulnerability

In phpMyAdmin before 4.4.15.9, when the user does not specify a blowfishsecret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created using a weak algorithm. This could allow an attacker to determine the user's...

CVE-2000-0800

String parsing error in rpc.kstatd in the linuxnfs or knfsd packages in SuSE and possibly other Linux systems allows remote attackers to gain root privileges...

[SECURITY] [DLA 110-1] libyaml security update

Package : libyaml Version : 0.1.3-1+deb6u5 CVE ID : CVE-2014-9130 Debian Bug : 771366 Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially crafted YAML input...

PT-2016-7858

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.17 phpMyAdmin versions 4.4.x through 4.4.15.8 phpMyAdmin versions 4.6.x through 4.6.4 Description An issue was discovered due to a bug in serialized string parsing, allowing bypass of the protection...

Mandrake Linux Security Advisory : ypserv (MDKSA-2000:064)

A format string parsing bug exists in ypbind 3.3 if it is run in debug mode which leaks file descriptors under certain circumstances which can lead to a DoS. In addition, ypbind may suffer from buffer overflows. In the ypserv program, a buffer overflow and format bug exist if the build system doe...

Symantec Veritas Storage Foundation vxsvc.exe Unicode String Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Veritas Storage Foundation. Authentication is not required to exploit this vulnerability. The specific flaw exists within the vxsvc.exe process. The problem affecting the part of the serve...

PT-2011-3609

Name of the Vulnerable Software and Affected Versions Adobe Shockwave affected versions not specified Description The issue is related to remote code execution due to a problem in string parsing within the rcsL component. Recommendations At the moment, there is no information about a newer versio...

Adobe Shockwave rcsL String Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

ZDI-10-155: Cisco WebEx Player ARF String Parsing Remote Code Execution Vulnerability

ZDI-10-155: Cisco WebEx Player ARF String Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-155 August 23, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Cisco -- Affected Products: Cisco WebEx -- TippingPointTM IPS Customer...

Cisco WebEx Player ARF String Parsing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco WebEx Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists during the parsing o...

Subversion svn Protocol String Parsing (CVE-2004-0413)

Subversion is a revision control system that handles svn protocol requests. A specially crafted svn request could cause svnserve, the daemon that handles svn protocol requests, to allocate insufficient heap memory and overflow the heap. It is possible for a malicious attacker to run arbitrary cod...

OpenBSD 4.6 NetBSD 5.0.1 - printf(1) Format String Parsing Denial of Service

OpenBSD 4.6 NetBSD 5.0.1 - printf1 Format String Parsing Denial of Service source: https://www.securityfocus.com/bid/36884/info OpenBSD and NetBSD are prone to a denial-of-service vulnerability because they fail to properly parse format strings to the 'printf1' function. An attacker can exploit...

DEBIAN-CVE-2009-2855

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function...