Microsoft Internet Explorer fails to properly interpret HTML with certain layout combinations

Overview A vulnerability in the way Microsoft Internet Explorer interprets malformed Web pages may lead to execution of arbitrary code. Description Microsoft Internet Explorer contatins a vulnerabilty that could be exploited when Internet Explorer attempts to interpret specially crafted Web pages...

Computer Associates BrightStor ARCserv and Protection Suite products RPC buffer overflow vulnerabilities

Overview Multiple vulnerabilities exist in Computer Associates backup products. If successfully exploited, these vulnerabilities may allow an attacker to execute arbitrary code. Description BrightStor ARCserve Backup is a backup and data retention tool that integrates with other BrightStor Data...

BIND vulnerable to an INSIST failure via sending of multiple recursive queries

Overview A vulnerability in the BIND name server could allow a remote attacker to cause a denial of service against an affected system. Description The Berkeley Internet Name Domain BIND is a popular Domain Name System DNS implementation from Internet Systems Consortium ISC. A flaw exists in the...

Sun ONE and Sun Java System Applications vulnerable to cross-site scripting via default error page

Overview A cross-site scripting vulnerability in Sun ONE and Sun Java System Applications may allow an attacker to read or modify data in web pages and cookies. Description From Sun Alert Notification 102164: A Cross Site Scripting XSS vulnerability in various releases of the Sun Java System Web...

X.Org server buffer overflow in Xrender extension

Overview A vulnerability in the X.Org X server could allow an attacker to execute arbitrary code with the privileges of the server. Description The X Window System provides a number of components to support graphical user interfaces, primarily on Unix-like operating systems. It features a...

Mozilla contains multiple memory corruption vulnerabilities

Overview Mozilla contains several memory corruption vulnerabilities. This may allow a remote attacker to execute arbitrary code. Description Mozilla team members have discovered multiple vulnerabilities that cause the browser engine to crash. In certain circumstances, these vulnerabilities may...

Mozilla may associate persisted XUL attributes with an incorrect URL

Overview Mozilla can allow persisted XUL attributes to associate with the wrong URL. This may allow a remote attacker to execute arbitrary code. Description XULXUL is an XML-based user interface language, which is used by Mozilla. Persisted XUL XUL elements with the persist attribute maintain the...

Mozilla privilege escalation using addSelectionListener

Overview A privilege escalation vulnerability exists in the Mozilla addSelectionListener method. This may allow a remote attacker to execute arbitrary code. Description addSelectionListener Web content can add a SelectionListener to the Selection object by using addSelectionListener method of the...

Mozilla XBL binding vulnerability

Overview Mozilla products fail to properly restrict access to privileged XBL bindings. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code. Description XBL According to Mozilla, XBL "is a markup language that defines special new elements, or 'bindings' for XU...

Mozilla products JavaScript engine fail to properly handle garbage-collection

Overview A vulnerability in the way the JavaScript engine of Mozilla products and derivative programs handles garbage collection could allow a remote attacker to execute arbitrary code on a vulnerable system. Description The JavaScript programming language uses a method of memory management known...

Microsoft Internet Explorer does not honor ActiveX kill bit

Overview Internet Explorer fails to properly check the kill bit for ActiveX controls, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable software components that can ...

Apple QuickTime fails to properly handle corrupt GIF images

Overview Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of files in the Graphics Interchange Format GIF could allow a remote attacker to execute arbitrary code on a vulnerable system. Description A heap overflow exists...

Multiple vulnerabilities in Internet Key Exchange (IKE) version 1 implementations

Overview Numerous vulnerabilities have been reported in various Internet Key Exchange version 1 IKEv1 implementations. The impacts of these vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, or cause an IKEv1 implementation to behave in an...

Optimistic TCP acknowledgements can cause denial of service

Overview A vulnerability in the TCP congestion control mechanism could be leveraged by an attacker to cause a denial of service. Description The Transmission Control Protocol TCP is described in RFC 793 as a means to provide reliable host-to-host transmission in a packet-switched computer network...

Microsoft Windows Graphics Rendering Engine buffer overflow vulnerability

Overview Microsoft Windows Graphics Rendering Engine contains a buffer overflow that may allow a remote attacker to execute arbitrary code on a vulnerable system. Description The Microsoft Windows Graphics Rendering Engine supports a number of image formats including Windows Metafile WMF and...

Helix Player format string vulnerability

Overview Helix Player, and media players based on the Helix Player, contain a format string vulnerability that may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Helix Player is used to play various types of media files on UNIX systems. The Helix Media Playe...

Microsoft DDS Library Shape Control (msdds.dll) COM object contains an unspecified vulnerability

Overview Microsoft DDS Library Shape Control COM object contains an unspecified vulnerability, which may allow a remote attacker to execute arbitrary code on a vulnerable system. Description Microsoft COMMicrosoft COM is a technology that allows programmers to create reusable software components...

Linux kernel Bluetooth support fails to properly bounds check "protocol" variable

Overview Linux kernels with Bluetooth support do not adequately validate the "protocol" value, allowing a local user to execute arbitrary code with elevated privileges. Description Linux kernels with Bluetooth support may contain a local root vulnerability, even if Bluetooth hardware is not...

Mozilla products vulnerable to heap overflow via specially crafted GIF file

Overview Mozilla products, including the Mozilla Suite, Mozilla Firefox, and Mozilla Thunderbird, are vulnerable to a heap-based overflow in the GIF image-processing routines. Description The Mozilla project produces an application suite Mozilla Suite, web browsers Mozilla Firefox, email software...

Microsoft COM Structured Storage Vulnerability

Overview A vulnerability in a way that various programs handle COM objects could allow a local attacker to execute arbitrary code on a vulnerable system. Description Microsoft's COM is a data representation that allows multiple kinds of objects to be stored in one document. COM structured storage...

Microsoft Internet Explorer contains a DHTML method heap memory corruption vulnerability

Overview Microsoft Internet Explorer contains a flaw in DHTML method handling which may allow a remote attacker to execute arbitrary code. Description The DHTML method handling in Internet Explorer fails to perform proper bounds checking. This vulnerability may allow data to be written outside th...

Multiple devices process HTTP requests inconsistently

Overview Multiple interconnected devices process valid HTTP request headers inconsistently and in this may manner may allow a remote attacker to poison a cache, conduct cross-site scripting attacks, and hijack user sessions. Attackers may use these flaws to launch a class of attacks referred to a...

SMB filesystem read system call vulnerable to buffer overflow

Overview The SMB filesystem read system call contains buffer overflow vulnerability that may allow an attacker to cause a denial-of-service condition. Description "Server Message Block SMB is an application-level protocol that supports file, printer, and other resource sharing. The SMB filesystem...

Microsoft Internet Information Server (IIS) 4.0 contains a buffer overflow in the redirect function

Overview There is a vulnerability in the redirect function of Microsoft's Internet Information Server IIS 4.0 that could allow an attacker to execute arbitrary code on an affected system. Description Internet Information Server IIS is a web server available for the Microsoft Windows operating...

BEA WebLogic Server contains vulnerability in handling of certain tags when editing "weblogic.xml"

Overview BEA WebLogic Server contains a vulnerability in the way Weblogic Builder and the SecurityRoleAssignmentMBean.toXML method parse certain tags in the weblogic.xml file. Description BEA Systems describes WebLogic Server as "an industrial-strength application infrastructure for developing,...

Microsoft Windows SSP interface fails to properly validate value used during authentication protocol selection

Overview A remotely exploitable vulnerability in Microsoft's Negotiate Security Software Provider SSP interface could permit an attacker to execute arbitrary code on the system. Description Microsoft's Negotiate Security Software Provider SSP interface contains a buffer overflow during the...

Microsoft Windows Virtual DOS Machine (VDM) contains null pointer dereference

Overview Microsoft Windows NT4.0 and Windows 2000 contain a vulnerability that could permit a local user to gain elevated privileges on the system. Description Microsoft Windows NT4.0 and Windows 2000 provide an Virtual DOS Machine VDM to support 16-bit legacy operations and applications. A...

Sun Solstice AdminSuite ships with insecure default configuration

Overview The sadmind service provided on many Solaris and SunOS systems ships with an insecure default configuration that allows remote users to execute arbitrary commands with superuser root privileges. Description The Sun Microsystems Solstice AdminSuite is a graphical tool that allows Solaris...

gnome-terminal allows arbitrary command execution when viewing files containing crafted escape sequences

Overview gnome-terminal may allow a remote attacker to execute arbitrary commands via crafted escape sequences. Description gnome-terminal affords users the ability to utilize an escape sequence to "export" the title of the current window title directly to the shell command line. By viewing a...

kernel-utils sets insecure permissions on "uml_net" utility

Overview The umlnet utility, part of the kernel-utils package in Red Hat Linux 8.0, was shipped with incorrect permissions. Description User-Mode Linux UML is a tool to provide a virtual machine in which to run another copy of Linux. In Red Hat linux 8.0, the kernel-utils package contains the UML...

MIT Kerberos V5 KDC logging routines use unsafe format strings

Overview Early releases of the MIT Kerberos V5 KDC contain format string vulnerabilities that can be used by unauthenticated remote attackers to conduct denial of service attacks on KDC servers. Description Logging routines in some unspecified versions of the MIT Kerberos V5 Key Distribution Cent...

Slash-based bulletin boards contain a "quick login" feature that may disclose username and password

Overview Slash-based bulletin boards contain a vulnerability that may cause users to disclose their username and password to third-party sites. Description As described in the Slashcode FAQ, "Slash is a database-driven news and message board, using Perl, Apache and MySQL." Slash allows web site...

Yahoo! Messenger contains buffer overflow in "message" field

Overview Yahoo! Messenger is an instant messaging client. There is a remotely exploitable buffer overflow vulnerability in the "message" field of Yahoo! Messenger. Description A remotely exploitable buffer overflow exists in the "message" field that may permit a remote attacker to execute arbitra...

OpenSSH contains a one-off overflow of an array in the channel handling code

Overview OpenSSH is a program used to provide secure connection and communications between client and servers. Channels are used to segregate differing traffic between the client and the server. Description OpenSSH versions 2.0 - 3.0.2 contain a one-off overflow of an array in the code that handl...

Oracle9i Application Server Apache PL/SQL module vulnerable to buffer overflow via HTTP Authorization header

Overview A buffer overflow vulnerability exists in the Apache Procedural Language/Structured Query Language PL/SQL module used by Oracle9i Application Server iAS. An HTTP Authorization header with a crafted password parameter could allow an unauthenticated remote attacker to cause a denial of...

Older Versions of Cisco PIX Firewall Manager permits retrieval of files

Overview A vulnerability in versions of the Cisco PIX Firewall Manager PFM in use circa September 1998 allows intruders to retrieve files from the host running PFM. Description A vulnerability in the Cisco PIx FIrewall manager allows an intruder to retrieve files from the host running PFM. In...

AOL Instant Messenger client for Windows contains a buffer overflow while parsing TLV 0x2711 packets

Overview There is a remotely exploitable buffer overflow in AOL Instant Messenger AIM. An exploit has been publicly released. AOL has implemented a server side fix that has largely eliminated the chances of widespread automated exploitation of the vulnerability, but targeted exploitation of...

Buffer overflows in Microsoft SQL Server 7.0 and SQL Server 2000

Overview There is a buffer overflow in Microsoft SQL Server 2000 and SQL Server 7.0 which could allow an intruder to execute arbitrary code on vulnerable systems. Description Microsoft Windows SQL Server 2000 and SQL Server 7.0 contain a buffer overflow in functions associated with text messages...

HP-UX Line Printer Daemon Vulnerable to Directory Traversal

Overview A remotely exploitable directory traversal vulnerability exists in the HP-UX line printer daemon. Description The line printer daemon rlpdaemon enables various clients to share printers over a network. By sending a specially crafted print request to an HP-UX host running the rlpdaemon, a...

Oracle9iAS Web Cache vulnerable to buffer overflow

Overview A remotely exploitable buffer overflow in the Oracle9iAS Web Cache allows intruders to execute arbitrary code or cause the web cache process to hang or exit. Description Defcom Labs has discovered a remotely exploitable buffer overflow vulnerability in the Oracle9iAS Web Cache on all...

Microsoft PowerPoint and Excel fail to properly detect macros thereby automatically executing malicious code via crafted document (MS01-050)

Overview A malformed Microsoft Excel or PowerPoint document can bypass macro checking thereby allowing arbitrary code to be run on the target system. Description Microsoft Excel and PowerPoint scan documents when they are opened and check for the existence of macros. If the document contains...

Cisco IOS vulnerable to DoS via crafted PPTP packet sent to port 1723/tcp

Overview Cisco IOS contains a vulnerability that allows an intruder to crash the router. Description By sending a specially crafted PPTP packet to port 1723, an intruder can crash a device running a vulnerable version of IOS. Quoting from the Cisco Advisory: By sending a crafted PPTP packet to a...

tcpdump vulnerable to buffer overflow via parsing of AFS ACL packets

Overview Tcpdump version 3.5 contains a buffer overflow vulnerability permitting unauthorized remote root access. Description Tcpdump version 3.5 added support for handling AFS packets. Unfortunately the code responsible for printing AFS access control lists contains an unchecked buffer that can ...

RIT Research Labs The Bat! does not properly parse <CR> characters not followed by a <LF> character

Overview Due to a problem parsing carriage return/line feeds in RFC822 format mail messages, The Bat! mail client may permaturely detect the end of a mail message, causing an error to occur. This error may prevent the mail user from retrieving other mail messages until the message with the error ...

Internet Explorer incorrectly validates certificates when CRL checking is enabled

Overview Microsoft Internet Explorer IE fails to properly validate certificates when CRL checking is enabled. As a result, sensitive information may be exposed. Description Digital certificates are small documents used to authenticate and encrypt information transmitted over the Internet. One ver...

MatrixSSL contains multiple vulnerabilities

Overview MatrixSSL, version 3.8.5 and earlier, contains heap overflow, out-of-bounds read, and unallocated memory free operation vulnerabilities. Description CWE-122: Heap-based Buffer Overflow - CVE-2016-6890The Subject Alt Name field of X.509 certificates is not properly parsed. A specially...

Acer Portal app for Android does not properly validate SSL certificates

Overview The Acer Portal app for Android allows customers to connect to the Acer Cloud. The Acer Portal app, from version 3.9.3.2003 to 3.9.3.2006, does not properly validate SSL certificates when connecting to the Acer Cloud. Description CVE-2016-5648 - CWE-295: Improper Certificate Validation T...

IPSwitch WhatsUp Gold does not validate commands when deserializing XML objects

Overview IPSwitch WhatsUp Gold version 16.3 does not properly validate data when deserializing XML objects sent over SOAP requests. Description CWE-502: Deserialization of Untrusted Data - CVE-2015-8261 WhatsUp Gold version 16.3 contains a SOAP request handler named DroneDeleteOldMeasurements...

Epiphany Cardio Server is vulnerable to SQL and LDAP injection

Overview The Epiphany Cardio Server is vulnerable to SQL injection and LDAP injection, allowing an unauthenticated attacker to gain administrator rights. Description Epiphany Cardio Server was reported as being vulnerable to the following issues:CWE-89: Improper Neutralization of Special Elements...

Qolsys IQ Panel contains multiple vulnerabilities

Overview All firmware versions of Qolsys IQ Panel contain hard-coded cryptographic keys, do not validate signatures during software updates, and use a vulnerable version of Android OS. Description Qolsys IQ Panel is an Android OS-based touch screen controller for home automation devices and...