security flaw

Heap-based buffer overflow in the oleinforeadmetabat function in Gnome Structured File library libgsf 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large nummetabat value in an OLE document, which causes the oleinitinfo function to...

Moderate: Red Hat Security Advisory: libgsf security update

Updated libgsf packages that fix a buffer overflow flaw are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The GNOME Structured File Library is a utility library for reading and writing structured file formats. A heap based buff...

DEBIAN-CVE-2007-0107

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7...

LibGSF远程堆溢出漏洞

GNOME Structured File Library是一款勇于读取和写结构文件格式的工具库 GNOME Structured File Library存在堆溢出问题，远程攻击者可以利用漏洞以链接此库的应用程序进程权限执行任意指令。 问题存在于'oleinitinfo'函数中，此函数当分配内存时只分配'numbat'指定的数目大小，当读取文件内容时，'nummetabat'指定的数目用于循环的边界，由于不正确的对变量进行验证，可导致堆溢出，精心构建恶意文件内容。诱使用户解析，可以链接此库的应用程序进程权限执行任意指令。 libgsf libgsf 1.14.1 libgsf libg...

LibGSF程序库远程堆溢出漏洞

GNOME结构化文件库（LibGSF）是用于读写结构化文件格式的工具库。 多家厂商的操作系统中所捆绑的libgsf库的oleinitinfo函数中存在堆溢出漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 在分配内存时oleinitinfo函数仅获得了numbat中所指定数目的空间，然后在读取文件内容时nummetabat中所指定的数目被用作了循环的边界。由于没有充分地验证变量，因此攻击者可能通过诱骗用户打开特制的OLE文档触发堆溢出，导致执行任意指令。 Jody Goldberg libgsf 1.14.1 Jody Goldberg libgsf 1.14 Jody...

iDefense Security Advisory 11.30.06: Multiple Vendor libgsf Heap Overflow Vulnerability

Multiple Vendor libgsf Heap Overflow Vulnerability iDefense Security Advisory 11.30.06 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 30, 2006 I. BACKGROUND The GNOME Structured File Library is a utility library for reading and writing structured file formats. This library replaces...

CVE-2006-4514

Heap-based buffer overflow in the oleinforeadmetabat function in Gnome Structured File library libgsf 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large nummetabat value in an OLE document, which causes the oleinitinfo function to...

CVE-2006-4514

Heap-based buffer overflow in the oleinforeadmetabat function in Gnome Structured File library libgsf 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large nummetabat value in an OLE document, which causes the oleinitinfo function to...

CVE-2006-4514

Heap-based buffer overflow in the oleinforeadmetabat function in Gnome Structured File library libgsf 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large nummetabat value in an OLE document, which causes the oleinitinfo function to...

DEBIAN-CVE-2006-4514

Heap-based buffer overflow in the oleinforeadmetabat function in Gnome Structured File library libgsf 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large nummetabat value in an OLE document, which causes the oleinitinfo function to...

CVE-2006-4514

Heap-based buffer overflow in the oleinforeadmetabat function in Gnome Structured File library libgsf 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large nummetabat value in an OLE document, which causes the oleinitinfo function to...

CVE-2006-4514

CVE-2006-4514 affects GNOME Structured File Library (libgsf) 1.14.0 and earlier than 1.14.2. The vulnerability is a heap-based buffer overflow in ole_info_read_metabat that, due to insufficient memory allocation in ole_init_info when handling large num_metabat values in OLE documents, can allow c...

Debian DSA-1221-1 : libgsf - buffer overflow

'infamous41md' discovered a heap buffer overflow vulnerability in libgsf, a GNOME library for reading and writing structured file formats, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

PT-2006-6735 · Baal · Baalasp Forum

Name of the Vulnerable Software and Affected Versions: BaalAsp forum affected versions not specified Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be exploited through...

MS Windows COM Structured Storage Local Exploit (MS05-012)

No description provided by source. // by Cesar Cerrudo - Argeniss - www.argeniss.com // MS05-012 - COM Structured Storage Vulnerability - CAN-2005-0047 Exploit // // More exploits at www.argeniss.com/products.html // // Works on Win2k sp4, WinXP sp2, Win2k3 sp0 // Close all runing programs to avo...

PT-2006-3745 · X Cart · X-Cart

Name of the Vulnerable Software and Affected Versions: X-Cart Gold and Pro versions 4.0.18 through 4.1.0 beta 1 Description: The issue allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field in search.php, when the settings specify only "Search in Detailed...

MS Office Products Array Index Bounds Error (unpatched) PoC

Exploit for unknown platform in category dos / poc =========================================================== MS Office Products Array Index Bounds Error unpatched PoC =========================================================== Full archive at http://www.milw0rm.com/sploits/excel03262006.rar Top...

Microsoft Office 2002 - Excel/Powerpoint/Word.. 10.0.2614.0 => 11.0.5612.0

Full archive at http://www.milw0rm.com/sploits/excel03262006.rar Topic : Microsoft Office 2002 - Excel/Powerpoint/Word.. 10.0.2614.0 = 11.0.5612.0 Date : 02/12/2006 Author : posidron [email protected] Table of Contens ================ - Some Excel Information - The XLS File Format and...

wmp_overflow.htm.txt

WMP Plugin EMBED Exploit // Windows Media Player Plug-In EMBED Overflow Universal Exploit MS06-006 // By Matthew Murphy [email protected] // // DISCLAIMER: // // This exploit code is intended only as a demonstration tool for // educational or testing purposes. It is not intended to be used for...

MS Windows Media Player 10 Plugin Overflow Exploit (MS06-006)

Exploit for unknown platform in category remote exploits ============================================================= MS Windows Media Player 10 Plugin Overflow Exploit MS06-006 ============================================================= WMP Plugin EMBED Exploit // Windows Media Player Plug-In...