Core Security Technologies Advisory 2008.0425

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ NASA BigView Stack Buffer Overflow Advisory Information Title: NASA BigView Stack Buffer Overflow Advisory ID: CORE-2008-0425 Advisory URL:...

NCTAudioInformation2 ActiveX控件栈溢出漏洞

CVECAN ID: CVE-2008-0959 NCTAudioInformation是Online Media Technologies（之前名为NCT公司）推出的用于更改声音文件中信息的ActiveX 控件，支持WAV、MP3、WMA等格式的文件。 NCTAudioInformation2控件（NCTAudioInformation2.dll）没有正确地处理GetAudioInformation和SetAudioInformation属性的参数，如果用户受骗访问了恶意网页并向这些参数传送了超长参数的话，就可以触发栈溢出，导致执行任意指令。 Online Media...

Stack overflow

Multiple stack-based buffer overflows in the Online Media Technologies NCTSoft NCTAudioGrabber2 ActiveX control in NCTAudioGrabber2.dll allow remote attackers to execute arbitrary code via unspecified vectors...

Stack overflow

Multiple stack-based buffer overflows in the Online Media Technologies NCTSoft NCTAudioInformation2 ActiveX control in NCTAudioInformation2.dll, as used in 1 Power Audio CD Grabber 1.0, 2 Power Audio CD Burner 1.02, 3 CinematicMP3 1.4.0.0, 4 Alive MP3 WAV Converter 3.9.3.2, and possibly other...

CVE-2008-0959

Multiple stack-based buffer overflows in the Online Media Technologies NCTSoft NCTAudioInformation2 ActiveX control in NCTAudioInformation2.dll, as used in 1 Power Audio CD Grabber 1.0, 2 Power Audio CD Burner 1.02, 3 CinematicMP3 1.4.0.0, 4 Alive MP3 WAV Converter 3.9.3.2, and possibly other...

CVE-2008-0958

The CVE-2008-0958 issue affects Online Media Technologies’ NCTSoft NCTAudioGrabber2 ActiveX control (NCTAudioGrabber2.dll). It describes multiple stack-based buffer overflows when handling certain properties, allowing a remote attacker to execute arbitrary code by convincing a user to view a mali...

CVE-2008-0959

CVE-2008-0959 affects Online Media Technologies NCTSoft NCTAudioInformation2 ActiveX control (NCTAudioInformation2.dll). The vulnerability consists of multiple stack-based buffer overflows when handling GetAudioInformation() and SetAudioInformation() parameters, enabling remote code execution via...

Online Media Technologies NCTSoft NCTAudioInformation2 ActiveX stack buffer overflows

Overview The Online Media Technologies NCTSoft NCTAudioInformation2 ActiveX control contains multiple stack buffer overflows, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Online Media Technologies, which was formerly known as NCT...

CORE-2008-0415: Borland Interbase 2007 Integer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Borland Interbase 2007 Integer Overflow Advisory Information Title: Borland Interbase 2007 Integer Overflow Advisory ID: CORE-2008-0415 Advisory URL:...

libid3tag拒绝服务漏洞

BUGTRAQ ID: 29210 CVECAN ID: CVE-2008-2109 libid3tag是MPEG音频解码器MAD中所捆绑的ID3标签操控库。 libid3tag库在解析ID3FIELDTYPESTRINGLIST字段时如果所要解析的数据以\0结尾的话，ptr == 0，但end - ptr条件为1，所以循环会无限继续。 以下是有漏洞的代码段： field.c 2003-04-19 09:14:33.000000000 +0900 --- field-patched.c 2008-01-13 16:08:22.000000000 +0900 291,297 end = p...

NASA's Common Data Format Buffer Overflow

Advisory ID Internal CORE-2008-0326 Advisory Information: Advisory ID: CORE-2008-0326 Advisory URL:https://www.coresecurity.com/?action=item&id=2260 Date published: 2008-05-05 Date of last update: 2008-05-05 Vendors contacted: GODDARD Space Flight Center Release mode: Coordinated release...

[SECURITY] Fedora 7 Update: galeon-2.0.3-17.fc7

Galeon is a web browser built around Gecko Mozilla's rendering engine and Necko Mozilla's networking engine. It's a GNOME web browser, designed to take advantage of as many GNOME technologies as makes sense. Galeon was written to do just one thing - browse the web...

cevado technologies real estate CMS SQL injection

I'm back, and I got more. SQL injection within some real estate CMS software. The vulnerability is present because of a failure to strip characters from the variables pageid and siteid resulting in exploitation by some simple blind SQLI. heres an example:...

[SECURITY] Fedora 8 Update: galeon-2.0.4-1.fc8.3

Galeon is a web browser built around Gecko Mozilla's rendering engine and Necko Mozilla's networking engine. It's a GNOME web browser, designed to take advantage of as many GNOME technologies as makes sense. Galeon was written to do just one thing - browse the web...

[SECURITY] Fedora 7 Update: galeon-2.0.3-16.fc7

Galeon is a web browser built around Gecko Mozilla's rendering engine and Necko Mozilla's networking engine. It's a GNOME web browser, designed to take advantage of as many GNOME technologies as makes sense. Galeon was written to do just one thing - browse the web...

Stack overflow

Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY...

CVE-2008-1358

Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY...

CVE-2008-1358

The CVE-2008-1358 entry concerns Alt-N MDaemon IMAP Server (Windows) 9.6.4, which is affected by a stack-based buffer overflow in the IMAP FETCH BODY handling. A remote authenticated user can exploit this by sending an overly long FETCH BODY command, with potential arbitrary code execution within...

Several critical security vulnerabilities have been addressed in the newest releases of VMware's hosted product line

a. Host to guest shared folder HGFS traversal vulnerabilityOn Windows hosts, if you have configured a VMware host to guest shared folder HGFS, it is possible for a program running in the guest to gain access to the host's file system and create or modify executable files in sensitive locations...

CVE-2008-1358: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY...