Portcullis Security Advisory 05-009

Portcullis Security Advisory Vulnerable System: Webseries Payment Application Vulnerability Title: Execute Of Arbitrary Reports Vulnerability discovery and development: Portcullis Security Testing Services Affected systems: Bottomline Webseries Payment Application Details: Portcullis consultants...

DEBIAN-CVE-2004-1204

FluxBox 0.9.10 and earlier versions allows local users to cause a denial of service application crash by calling Xman with a long -title value, possibly triggering a buffer overflow...

CVE-2004-1153: Undefined Security Weakness

Format string vulnerability in Adobe Acrobat Reader 6.0.0 through 6.0.2 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via an .ETD document containing format string specifiers in 1 title or 2 baseurl fields...

CVE-2004-1204: Undefined Security Weakness

FluxBox 0.9.10 and earlier versions allows local users to cause a denial of service application crash by calling Xman with a long -title value, possibly triggering a buffer overflow...

CVE-2003-0063

The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the...

CVE-2003-0065

The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitra...

CVE-2003-0066

The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to...

CVE-2003-0067

The aterm terminal emulator 0.42 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute...

CVE-2003-0069

The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute...

CVE-2003-0065

CVE-2003-0065 concerns the uxterm terminal emulator window-title reporting vulnerability. A malicious escape sequence can modify the terminal window title and, when echoed back to the command line, enable attacker-controlled input to be executed by the user’s shell. The related literature documen...

CVE-2003-0070

CVE-2003-0070 affects VTE as used by gnome-terminal; the vte_sequence_handler_window_manipulation routine fails to sanitize certain escape sequences, allowing an attacker to modify the window title and inject it back into the command line, potentially enabling arbitrary command execution. This is...

CVE-2003-0070

VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containin...

CVE-2003-0064

The dtterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitra...

CVE-2003-0068

The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker t...

CVE-2003-0064

The CVE concerns dtterm and related terminals’ Window Title Reporting feature. An attacker can craft an escape sequence that places the current window title on the command line, and the user must press Enter for the command to execute, enabling arbitrary command execution on the vulnerable host. ...

CVE-2003-0070

VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containin...

CVE-2003-0066

Removed by vendor...

CVE-2003-0066

The CVE-2003-0066 issue affects rxvt 2.7.8 and earlier. A vulnerable escape sequence allows an attacker to modify the window title and have that title re-enter the shell as a command, enabling arbitrary command execution when a user views a file containing the malicious sequence. The root cause i...

CVE-2003-0066: Undefined Security Weakness

The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to...

CVE-2003-0068: Undefined Security Weakness

The Eterm terminal emulator 0.9.1 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker t...