adobealbum-overflow.txt

Exploitable issue in various Adobe products c0ntex [email protected] Scott Laurie February 2008 Vulnerable applications, tested: Adobe Photoshop Album Starter Adobe After Effects CS3 Adobe Photoshop CS3 Not Vulnerable applications, tested: Adobe Reader Adobe Flash Player This bug is related to th...

Re: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

On Mar 27, 2:09pm, [email protected] [email protected] wrote: -- Subject: securityreason BSD libc strfmon Multiple vulnerabilities ... stuff deleted ... | Problem exist also in printf function. | | Example code will show Integer Overflow . | | - ---example-start-- | include stdio.h | ...

FreeBSD : qemu -- unchecked block read/write vulnerability (9cfbca7f-efb7-11dc-be01-0211060005df)

Ian Jackson reports on the debian-security mailinglist : When a block device read or write request is made by the guest, nothing checks that the request is within the range supported by the backend, but the code in the backend typically assumes that the request is sensible. Depending on the...

CSA-L03: Linux kernel vmsplice unchecked user-pointer dereference

=== ABSTRACT ========================================================= A new vmsplice system call was introduced in the 2.6.17 release of the Linux kernel. In the 2.6.23 kernel the system call functionality has been further extended resulting in two new critical vulnerabilities. === AFFECTED...

CVE-2008-0008

The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from 1 setresuid, 2 setreuid, 3 setuid, and 4 seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as...

pulseuadio privilege escalation

setuid result is not checked...

Debian Security Advisory DSA 1023-1 (kaffeine)

The remote host is missing an update to kaffeine announced via advisory DSA 1023-1. Marcus Meissner discovered that kaffeine, a versatile media player for KDE 3, contains an unchecked buffer that can be overwritten remotely when fetching remote RAM playlists which can cause the execution of...

Microsoft Word 2000/2003 Unchecked Boundary Condition Vulnerability

No description provided by source. /------------------------------------------------------------ Microsoft Word unchecked boundary condition vulnerability. --------------------------------------------------------- One of the functions in mso.dll older versions mso9.dll...

Linux mount / umount privilege escalation

Invalid order of setuid / setgid calls and unchecked return value...

Windows RSH Daemon Buffer Overflow

This module exploits a vulnerability in Windows RSH daemon 1.8. The vulnerability is due to a failure to check for the length of input sent to the RSH server. A CPORT of 512 - 1023 must be configured for the exploit to be successful. Module Options msf use exploit/windows/misc/windows/rsh msf...

CVE-2007-3798

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value...

CVE-2007-3798

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value...

CVE-2007-0041

The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow...

CVE-2007-0041

The PE Loader service in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to execute arbitrary code via unspecified vectors involving an "unchecked buffer" and unvalidated message lengths, probably a buffer overflow...

BitchX 1.1-final - 'EXEC' Remote Command Execution

/ Name: PBXS - Pointless BitchX Sploit Author: clarity Infected Versions: 1.1-final and others? Synopsis: BitchX suffers from a unchecked bounds in a hash table in hook.c where one can inject data structures allowing for the remote execution of commands! Usage: Execute "gcc -o pbxs pbxs.c; ./pbxs...

BitchX 1.1-final (EXEC) Remote Command Execution Exploit

Exploit for linux platform in category remote exploits ======================================================== BitchX 1.1-final EXEC Remote Command Execution Exploit ======================================================== / Name: PBXS - Pointless BitchX Sploit Author: clarity Infected Versions:...

Microsoft Excel BIFF File Format Named Graph Record Parsing Stack Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. Exploitation requires that the attacker coerce the target into opening a malicious .XLS file. The specific flaw exists within the parsing of the BIFF file format used by...

CVE-2007-1188

WebAPP before 0.9.9.5 allows remote attackers to submit Search form input that is not checked for 1 composition or 2 length, which has unknown impact, possibly related to "search form hijacking"...

Design/Logic Flaw

WebAPP before 0.9.9.5 does not check access in certain contexts related to 1 Calendar Administration, 2 Instant Messages Administration, and 3 the Image Uploader, which has unknown impact and attack vectors...

webspell40-multi.txt

WebSpell Authentication Bypass and arbitrary code execution Vendor : WebSpell URL : http://www.webspell.org/ Version : All Risk : SQL Injection, unchecked file upload Description: webSPELL is a free Content Management System CMS for clans and gaming communities, providing all needed features like...