[oCERT-2008-009] libxslt heap overflow

2008/07/31 2008-009 libxslt heap overflow Description: The libexslt library bundled with libxslt is affected by a heap-based buffer overflow which can lead to arbitrary code execution. The vulnerability is present in the rc4 encryption/decryption functions. An arbitrary length string, passed as a...

GLSA-200806-02 : libxslt: Execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200806-02 libxslt: Execution of arbitrary code Anthony de Almeida Lopes reported a vulnerability in libxslt when handling XSL style-sheet files, which could be exploited to trigger the use of uninitialized memory, e.g. in a call t...

Race condition

Race condition in NSXML in Foundation for Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a crafted XML file, related to "error handling logic."...

CVE-2008-0059

Race condition in NSXML in Foundation for Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a crafted XML file, related to "error handling logic."...

Design/Logic Flaw

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.fromxml Hashfromxml method, which uses XmlSimple XML::Simple unsafely, as demonstrated by reading passwords fro...

CVE-2007-4600

The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element...

CVE-2006-7065

Microsoft Internet Explorer allows remote attackers to cause a denial of service crash via an IFRAME with a certain XML file and XSL stylesheet that triggers a crash in mshtml.dll when a refresh is called, probably a null pointer dereference...

iTunes remote memory corruption vulnerability

Hi, iTunes for both macosx and win is prone to a remote memory corruption vulnerability when parsing xml. iTunes will parse xml when it contacts a touning server which will return the list of radio channels in that format. To trigger this bug is sufficent to send to iTunes an xml file containing...

DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability'

DMA2007-0104a - 'iLife iPhoto Photocasing Format String Vulnerability' Author: Kevin Finisterre Vendors: http://www.apple.com Product: 'iLife 06 ?' References: http://www.digitalmunition.com/DMA2007-0104a.txt http://www.apple.com/ilife/iphoto/features/photocasting.html...

Quicktime crossite scripting

XML file with .MOV extension allows to execute script in local zone with qtnext parameter of EMBED tag with embedded short movie...

CVE-2006-4253

Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads...

CVE-2006-4253

Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads...

GLSA-200607-12 : OpenOffice.org: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200607-12 OpenOffice.org: Multiple vulnerabilities Internal security audits by OpenOffice.org have discovered three security vulnerabilities related to Java applets, macros and the XML file format parser. Specially crafted Java...

OpenOffice.org: Multiple vulnerabilities

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description Internal security audits by OpenOffice.org have discovered three security vulnerabiliti...

EEYE: McAfee ePolicy Orchestrator Remote Compromise

McAfee ePolicy Orchestrator Remote Compromise Release Date: July 13, 2006 Severity: High Remote Code Execution Vendor: McAfee Systems Affected: McAfee Common Management EPO Agent versions below version 3.5.5.438 Overview: McAfee ePolicy Orchestrator is the remote security management software for...

GNOME Evolution 2.2.3/2.3.x - Inline XML File Attachment Buffer Overflow

source: https://www.securityfocus.com/bid/16408/info GNOME Evolution email client is prone to a denial-of-service vulnerability when processing messages containing inline XML file attachments with excessively long strings. perl -e 'printf "A"x40000' evolution-dos-poc.xml...

GNOME Evolution 2.2.32.3.x - Inline XML File Attachment Buffer Overflow

GNOME Evolution 2.2.32.3.x - Inline XML File Attachment Buffer Overflow source: https://www.securityfocus.com/bid/16408/info GNOME Evolution email client is prone to a denial-of-service vulnerability when processing messages containing inline XML file attachments with excessively long strings. pe...

FileZilla 2.2.15 - FTP Client Hard-Coded Cipher Key

FileZilla 2.2.15 - FTP Client Hard-Coded Cipher Key // source: https://www.securityfocus.com/bid/14730/info FileZilla FTP client may allow local attackers to obtain user passwords and access remote servers. The application uses a hard-coded cipher key to decrypt the password, which is stored in a...

FileZilla 2.2.15 - FTP Client Hard-Coded Cipher Key

// source: https://www.securityfocus.com/bid/14730/info FileZilla FTP client may allow local attackers to obtain user passwords and access remote servers. The application uses a hard-coded cipher key to decrypt the password, which is stored in an XML file or the Windows Registry. This can allow t...

Read parts of any XML-file via customize parameter in Oracle Reports

Name Read parts of any XML-file via customize parameter in Oracle Reports Systems Affected All version of Oracle Reports Severity Medium Risk Category Information disclosure Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Adviso...