[Backports-security-announce] Security Update for openoffice.org

Rene Engelhard uploaded a new package for openoffice.org which fixed the following security problems: CVE-2010-0136 It was discovered that macro security settings were insufficiently enforced for VBA macros. CVE-2009-0217 It was discovered that the W3C XML Signature recommendation contains a...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:229)

An off-by-one error was found in ClamAV versions prior to 0.94.1 that could allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted VBA project file CVE-2008-5050. Other bugs have also been corrected in 0.94.1 which is being provided with this update...

Mandriva Update for clamav MDVSA-2008:229 (clamav)

Check for the Version of clamav OpenVAS Vulnerability Test Mandriva Update for clamav MDVSA-2008:229 clamav Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Ubuntu: Security Advisory (USN-672-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-200812-21 : ClamAV: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200812-21 ClamAV: Multiple vulnerabilities Moritz Jodeit reported an off-by-one error within the getunicodename function in libclamav/vbaextract.c when processing VBA project files CVE-2008-5050. Ilja van Sprundel reported an...

ClamAV: Multiple vulnerabilities

Background Clam AntiVirus is a free anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. Description Moritz Jodeit reported an off-by-one error within the getunicodename function in libclamav/vbaextract.c when processing VBA project files CVE-2008-5050. Ilja van...

[Backports-security-announce] Security Update for clamav

Sebastian Harl uploaded new packages for clamav which fixed the following security problems: CVE-2008-5050, Debian BTS 505134 Moritz Jodeit discovered that ClamAV, an anti-virus solution, suffers from an off-by-one-error in its VBA project file processing, leading to a heap-based buffer overflow...

ClamAV < 0.94.1 Off-By-One Heap based Buffer Overflow Vulnerability

ClamAV is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:clamav:clamav";...

USN-672-1: ClamAV vulnerability

Moritz Jodeit discovered that ClamAV did not correctly handle certain strings when examining a VBA project. If a remote attacker tricked ClamAV into processing a malicious VBA file, ClamAV would crash, leading to a denial of service...

DEBIAN-CVE-2008-5050

Off-by-one error in the getunicodename function libclamav/vbaextract.c in Clam Anti-Virus ClamAV before 0.94.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow...

CVE-2008-5050

Off-by-one error in the getunicodename function libclamav/vbaextract.c in Clam Anti-Virus ClamAV before 0.94.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow...

Heap overflow

Off-by-one error in the getunicodename function libclamav/vbaextract.c in Clam Anti-Virus ClamAV before 0.94.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow...

CVE-2008-5050

Off-by-one error in the getunicodename function libclamav/vbaextract.c in Clam Anti-Virus ClamAV before 0.94.1 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow...

ClamAV get_unicode_name()单字节堆溢出漏洞

BUGTRAQ ID: 32207 Clam AntiVirus是Unix的GPL杀毒工具包，很多邮件网关产品都在使用。 ClamAV中负责解析VBA项目文件的代码中存在单字节堆溢出漏洞，如果用户发送了带有恶意附件的邮件的话，就可能导致以clamd进程的权限执行任意指令。 具体来讲，向libclamav/vbaextract.c中的getunicodename函数传送了特定的name缓冲区就可以触发这个溢出： 101 static char 102 getunicodenameconst char name, int size, int bigendian 103 104 int i,...

ClamAV get_unicode_name&#40;&#41; off-by-one buffer overflow

----------------------------------------------------------------- ClamAV getunicodename off-by-one buffer overflow Copyright c 2008 Moritz Jodeit [email protected] 2008/11/08 ----------------------------------------------------------------- Application details: From http://www.clamav.net/: "Clam...

FreeBSD : clamav -- off-by-one heap overflow in VBA project parser (24b64fb0-af1d-11dd-8a16-001b1116b350)

Advisory from Moritz Jodeit, November 8th, 2008 : ClamAV contains an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the clamd' process by sending an emai...

ClamAV < 0.94.1 get_unicode_name() Function Off-by-One Buffer Overflow (deprecated)

Binary data 4744.prm...

ClamAV < 0.94.1 get_unicode_name() Off-by-One Buffer Overflow

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.1. Such versions have an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files, specifically in the 'getunicodename' function of 'libclamav/vbaextract.c', when a...

clamav -- off-by-one heap overflow in VBA project parser

Advisory from Moritz Jodeit, November 8th, 2008: ClamAV contains an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the clamd' process by sending an email...

Microsoft Excel日历对象验证远程代码执行漏洞（MS08-057）

BUGTRAQ ID: 31702 CVECAN ID: CVE-2008-3477 Excel是微软Office办公套件中的电子表格工具。 Excel处理VBA性能缓存的方式中存在一个远程执行代码漏洞。如果用户在VBA性能缓存中打开一个特制Excel文件，该漏洞可能触发堆溢出、内存破坏、无效数组索引或整数溢出等。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Excel 2003 SP3 Microsoft Excel 2003 SP2 Microsoft Excel 2002 SP3...